24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 044ef3d12efb… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 044ef3d12efb…. Malware family: Trojan.Generic. Threat score 85/100. 1/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4"],"about":{"@type":"SoftwareApplication","name":"OPCG-Online-Setup-0.14.0-alpha.24+426_044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe","applicationCategory":["compressed","innosetup"],"identifier":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta0c,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp")26:T4de,Found string - \\.\DISPLAY1; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp")27:T1d63,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/OM.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PA.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PE.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PF.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PG.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PH.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PK.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PL.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PM.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PN.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PR.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PS.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PT.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PW.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/PY.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/QA.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/RE.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/RO.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/RS.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/RU.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/RW.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/SA.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/SB.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/SC.SVG.VEC") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/USERS/HAPUBWS/APPDATA/LOCAL/PROGRAMS/OPCG ONLINE/DATA/FLUTTER_ASSETS/PACKAGES/TWEMOJI_FLAGS/FLAGS_DIST/SD.SVG.VEC")28:T894,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815437208 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815445928 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815624289 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815633595 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815770264 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815778968 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815929412 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" queried SystemProcessInformation at 00000000-00004780-00000C15-815938149 [PID: 4780] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queried SystemProcessInformation at 00000000-00002088-00000C15-816916119 [PID: 2088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queried SystemProcessInformation at 00000000-00002088-00000C15-816926377 [PID: 2088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queried SystemProcessInformation at 00000000-00002088-00000C15-817385138 [PID: 2088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queried SystemProcessInformation at 00000000-00002088-00000C15-817394611 [PID: 2088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queried SystemProcessInformation at 00000000-00002088-00000C15-821973175 [PID: 2088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queried SystemProcessInformation at 00000000-00002088-00000C15-821982000 [PID: 2088]29:T19a7,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-1LR7U5K4I3.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\unins000.exe" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-MT44135ELJ.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\desktop_drop_plugin.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-U7ESQDXKLZ.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\emoji_picker_flutter_plugin.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-PFKHS2C70Y.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\file_selector_windows_plugin.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-NUNLJ1G776.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\flutter_secure_storage_windows_plugin.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-XUTMEOLQIU.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\flutter_windows.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-1KSJHKZRY8.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\opcg_online.exe" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-A8UG3JXWTF.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\url_launcher_windows_plugin.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\is-1T0ZXBRO12.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\app.so" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\is-1M2SXJ3O98.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\icudtl.dat" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\is-7ZO9TWMIMB.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\AssetManifest.bin" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\is-MPWW7FKRSL.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\FontManifest.json" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\is-HM295PBWE8.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\NativeAssetsManifest.json" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\is-37NLDM14GH.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\NOTICES.Z" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-KTHKMVSC4R.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-Bold.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-0XIC5ZGQH4.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-BoldItalic.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-GL3CZNE200.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-Italic.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FI9D0P02XK.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-OFL.txt" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-H6HSH8WC8R.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-Regular.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-HB8O2B3YW1.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\BodoniModa-OFL.txt" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-EMJVXWXHVV.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\BodoniModa.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-VYELM2CN3Q.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-Bold.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FA91LXFA4T.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-BoldItalic.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-BVEO9B5ZXV.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-Italic.ttf" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-CLBU2HPI1S.tmp" to "%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-OFL.txt"2a:T1635,Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptEncrypt1" (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptEncrypt1" (Indicator: "CryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptEncrypt2" (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptEncrypt2" (Indicator: "CryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptDecrypt1" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptDecrypt1" (Indicator: "CryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptDecrypt2" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptDecrypt2" (Indicator: "CryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp")2b:T76f,file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "is-NUNLJ1G776.tmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptEncrypt1" (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptEncrypt2" (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt1" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt2" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp")2c:T42b,Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe")2d:T4e1,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BCryptDecrypt1" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt1" (Indicator: "CryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt2" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt2" (Indicator: "CryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp")2e:Tec7f,Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 369125; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 419637; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2217317; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2470484; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2562264; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2707965; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3221983; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3351648; code bytes = 30d0 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 587304; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1622353; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3690155; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3690202; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3690266; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3690349; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4238285; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4471800; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4471818; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4471840; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4471914; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4471931; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4472016; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4472029; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4472046; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 4681309; code bytes = 33c1 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 235830; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 236069; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 993477; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1252562; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1345162; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1350013; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1384201; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1384351; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1384537; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1386946; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1401037; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1401105; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 1401502; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2098014; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2105778; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2217821; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2218745; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2219652; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2254120; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2483308; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2489401; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 2589250; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3664727; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3664751; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3843704; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3877133; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3879235; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3884614; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 3965186; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 5172095; code bytes = 8030 Found XOR loop in file "is-XUTMEOLQIU.tmp" at offset 5185533; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4294852; code bytes = 33c1 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4230339; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4276367; code bytes = 8030 Found XOR loop in file "is-1LR7U5K4I3.tmp" at offset 4282454; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 27779; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 27794; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 27802; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 32649; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3166901; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3166960; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3166968; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3166979; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3172401; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3651324; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3655472; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3698984; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3700459; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3893252; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3922915; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3924367; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3925323; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3931541; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3932879; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3933045; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3939635; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3940329; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3942859; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3952387; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3959779; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3961037; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3972389; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3975797; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3983617; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3987071; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3990937; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4002193; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4006789; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4011773; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4018027; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4022167; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4025633; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4026371; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4035343; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4036067; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4044199; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4049113; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4058659; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4062327; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4063551; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4064555; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4065659; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4066177; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4067267; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4077999; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4083631; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4094553; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4105507; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4117267; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4117889; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4122363; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4123011; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4128199; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4131875; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4133441; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4138789; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4139379; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4148999; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4153465; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4155667; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4157685; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4158403; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4160923; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4161635; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4164607; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4170849; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4171587; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4182451; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4186075; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4187279; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4188575; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4190657; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4191071; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4191789; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4199459; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4205405; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4207011; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4209051; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4211103; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4213123; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4215127; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4217159; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4219175; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4221081; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4224815; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4226135; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4228227; code bytes = 30d0 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3123539; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3123572; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3123605; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3123638; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3123801; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3124043; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3192001; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3926239; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3939005; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3956099; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3961825; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3962555; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3988267; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4002303; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4013729; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4017031; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4017529; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4025199; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4025723; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4058823; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4063637; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4087955; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4104497; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4113959; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4122459; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4124945; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4144481; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4294852; code bytes = 33c1 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 2948293; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 2970549; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 2983733; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3017542; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3027916; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3051755; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3283153; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3283171; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3339946; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3340311; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3402942; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3404540; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3404570; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3404590; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3463807; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3463870; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3463907; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3463925; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3464256; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3464274; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3471557; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3567988; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3916306; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3916846; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3918936; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3922896; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3923710; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3925310; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3927982; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3932178; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3935608; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3938296; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3939600; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3941774; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3942822; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3945012; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3951070; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3951406; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3959752; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3962382; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3967208; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3969310; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3971826; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3989444; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3990018; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3995004; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3996380; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3998582; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 3999624; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4000600; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4010532; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4011144; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4021192; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4023382; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4026332; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4028040; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4035304; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4036028; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4044168; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4053204; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4056760; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4058620; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4064544; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4065056; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4072324; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4079568; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4083620; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4085890; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4086556; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4099344; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4102586; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4105472; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4107632; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4110860; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4112902; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4113604; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4122344; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4128658; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4131086; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4148960; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4149518; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4152008; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4155628; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4158364; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4160884; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4166089; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4176112; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4185760; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4191032; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4191760; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4192340; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4193502; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4203242; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4206972; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4209012; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4211064; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4213084; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4215088; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4217120; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4219142; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4223996; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4224776; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4226116; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4228188; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4230339; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4276367; code bytes = 8030 Found XOR loop in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" at offset 4282454; code bytes = 8030 Found XOR loop in file "is-NUNLJ1G776.tmp" at offset 96444; code bytes = 30d0 Found XOR loop in file "is-NUNLJ1G776.tmp" at offset 93899; code bytes = 33c1 Found XOR loop in file "is-NUNLJ1G776.tmp" at offset 152132; code bytes = 8030 Found XOR loop in file "is-NUNLJ1G776.tmp" at offset 152140; code bytes = 8030 Found XOR loop in file "is-1KSJHKZRY8.tmp" at offset 52395; code bytes = 33c1 Found XOR loop in file "is-1KSJHKZRY8.tmp" at offset 125068; code bytes = 33c1 Found XOR loop in file "is-1KSJHKZRY8.tmp" at offset 106579; code bytes = 8030 Found XOR loop in file "is-1KSJHKZRY8.tmp" at offset 112666; code bytes = 8030 Found XOR loop in file "is-PFKHS2C70Y.tmp" at offset 63979; code bytes = 33c1 Found XOR loop in file "is-A8UG3JXWTF.tmp" at offset 52755; code bytes = 33c1 Found XOR loop in file "is-MT44135ELJ.tmp" at offset 54072; code bytes = 30d0 Found XOR loop in file "is-MT44135ELJ.tmp" at offset 54080; code bytes = 30d0 Found XOR loop in file "is-MT44135ELJ.tmp" at offset 89828; code bytes = 30d0 Found XOR loop in file "is-MT44135ELJ.tmp" at offset 49655; code bytes = 33c1 Found XOR loop in file "is-U7ESQDXKLZ.tmp" at offset 45415; code bytes = 33c12f:T4a6,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp")30:Tdc5,file/memory contains long string with (Indicator: "postmessage"; File: "is-1KSJHKZRY8.tmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): LongInt;" (Indicator: "sendmessage"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;" (Indicator: "postmessage"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "9001816114,7236,110,,EnumWindows,user32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp")31:T89e,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Ready to Install" - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Setup is now ready to begin installing OPCG Online on your computer." - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Click Install to continue with the installation." - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "&Install" - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Preparing to Install" - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Setup is preparing to install OPCG Online on your computer." - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "&Next" - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Installing" - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Please wait while Setup installs OPCG Online on your computer." - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Creating directories..." - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Saving uninstall information..." - (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetWindowTextW" with parameter "Extracting files..." - (UID: 00000000-00002088)32:T386e,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008f001c00000000c011750000107580000000006006000010000020000000000000018c5d770a4c020000b0fa8f00e99cc877d035627408fa8f006fd7d77570fa8f00506aca77a05d770afeffffff80fa8f00e3e2d77506000000b0fa8f00f0d7d775b1b73ed50000000080363e0100009e740000000080363e01000000000000000048fa8f00b0336274dcfa8f00f0fbd975616053a0feffffffa8fa8f0029a85d744c0200009cfa8f000c000000e99cc87700000000080000000d00000000000000e8fa8f00205d770a00000000e8fa8f008ff75e740000000025bb73dd819e0401200d0f05a999040101000000f8620401000000006698040100fb8f00 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000f0510f50f05e05a0c0510f50f00905b0c05e05a0c0500f60f05d0f78f00a854160118f50f05b25416013c010000a7080a1ef4f78f0010f50f0510f50f05f4f78f0010f50f05ecf78f002b5e160190f88f00405e16014a5e160100f60f0500f60f05fcfa8f00da601601a7080a1ef4ffffff00000000000001085365676f65205549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f60f05 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008f00b08bf500c000f500c06fe773b88bf500b0f08f0098f08f00d06fe773d48bf500a74de77300000000b88bf500b74de7734533678b4ebcea730000000048b2af00ecf08f00ccf08f00c06fe773b88bf50004f18f00d8f08f00d06fe7730000000000000000000000008c586774b74de7730533678b000000004057770ab08bf5000240008038f18f00506aca77d8522a7dfeffffff48f18f0000167774905eaf0054b0f6732387c777e186c777f056770a000000008c586774b08bf50000000000905eaf00040000000016777410f18f00b08bf500b04d72746ed745da0000000048b2af00b08bf50013e6e9730000e1732c53f6733cf18f0080eee075 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f4860f0508000000000000000000000000000000b4fa8f0056b7d9750004000000010000f4860f0508000000f4860f05080000003c010000e4fa8f000800000010000000e8fa8f0042780601f4860f05080000005ef141ff7a6f0401b9ad04010cfb8f009c070501f80f3f010cfb8f008b070501f80f3f0108fb8f0013ca11011dca1101f0ae0d01a8501105a0280e0501000000f0ae0d0100000000a0bd0e053bd50e010200000000000000584f11058bde0e01f0ae0d0111980401a0bd0e05379b0401f0ae0d01a0bd0e05939b0401f0ae0d0106e40e0110e40e010100000068fb8f006cfb8f0026e40e01b8413e01ee000000d7413e01388c3101 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bc5e770a0000000070fa8f003f8ac7770000000001000000d0f98f00ffff00000c021005fb8cc77700000000000000000c021005a0fa8f000000000000000000000000006feb5e7409000000d037ae00090000000c0210050000000070a2da7500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000c85d770aa4fa8f0011b9d7750000b67798fa8f0000000000a0fa8f00000000006feb5e740000b67720b13c011c001d000c021005fcfcc977844fce77b5000000e8fa8f0004000000c0fa8f000c000000ecfa8f00648607004c0102000000000000000000230000c06e4fce773c01000070a2da75da4fce77c4010000000000000c0000004c5d770a08fb8f0083a2da75c401000007fb8f00000000006cfb8f00d6af3c01c401000020fb8f004c0164866c870f05000000000000067400000674000000006c870f050000000060fb8f00203013747a6f0401ddad04015cfb8f00 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000245f770ad0f88f0011b9d775be18c877585f770ae835af000000000020f98f006feb5e74000000000000000018001900a8f88f00b055b77744f98f00506aca7750502a7dfeffffffbe18c877a245c877e835af0088e8ae0038f98f00e835af00e835af0028f98f000000000028f98f006060c87705000000c00240019b6f040120f98f00f5b873ddccf48f000000000094f98f008226617415c89ea9feffffff60f98f00a4d711753e000e0096040000112700000000000000000000b7020000e1d71175df353b287cfb8f000c473c013e000e009604000011270000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000010d58f0038cfc7776c3bae007cd58f0001000000203bae006c3bae00203bae00040000000400000000e0e375001000007cd58f0001000000203bae00cd97c7779c97c7772470770ab50fda75203bae000000c777000000007c0d54750000000080eee0750100000024000000f8e2e3750000000004000000000000004840e275f8e2e37580d58f0080e8b274e0a2ae0080e8b2747cd58f000000000080e8b274142f00f9feffffff00000000000000000000000005000000f0a68f0702000000020000000a000000e0a68f07f0a68f070000000089983ed500d88f00ddf3d775f4d58f0000000000e0a68f070a000000f8f3d775e0a68f07 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000c6772d89c67700020000946a770a43003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c004300610063006800650073000000570053005c00530059005300540045004d00330032005c007500730065007200330032002e0064006c006c000000780030003000300030003000300030003000300030003000300030003000350030002e0064006200000064000000e99cc8770000000000000000ffffffff000000000000000000000000207eb400347eb400 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8aff50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006473770ae8aff50040d98f001cd98f0081f10f76e8aff50058de8f00e8da8f00c5f10f760000ae009834c777509c8f0748d98f001c600c760400000040d98f005c83a774e0aff500a090137600000000fcd58f0000000000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000b600f8ccb6003ecdb60000000000000000000000000000008f07ec9c8f077027b5749ea8b400589c8f0711000000b88e87740400000050a0a17400000000000000000000b40006000000589c8f070000a174000000000000000000008f002b310f7600000000000000000000000000000000ffffffff00000000000000000000000098fc8f07b0fc8f0798fc8f070000000000000000000000000000000000008f0798fc8f07defc8f0700000000000000000000000000008f07349f8f077027b5744081b400a09e8f070a000000b88e8774040000000000000000000000ffffffff0000000000000000000000006eafb00084afb000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000008802ae008000000048000000000000000000000009000000020000004403ae00010000003900000001000000c8bf8f0000000000eccf8f0710836f748e0d90070a000000000000003600000000000000010000000000004836000000983f9007410001010a000000983f90070000000048bb8f0739000039ef000000ff0300000000ae00a8b88f0700000000e0c3ae0048c08f0000aeae000e0212000e0212006002ae00e0c08f008357b97712aeae00d054b977a757b977ffffffffffffffff0000000094c08f000dfac67700aeae000000000000000000000000000000000000000000ffffffff0000000000000000000000008e9f8f07a69f8f07 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000008802ae008000000048000000000000000000000009000000020000004403ae00010000003900000001000000c8bf8f0000000000eccf8f0710836f748e0d90070a000000000000003600000000000000010000000000004836000000983f9007410001010a000000983f90070000000048bb8f0739000039ef000000ff0300000000ae00a8b88f0700000000e0c3ae0048c08f0000aeae000e0212000e0212006002ae00e0c08f008357b97712aeae00d054b977a757b977ffffffff987880574f8c6244bb6371042380b10900000000008c624450a0a174000000000000000000000000ffffffff000000000000000000000000fe7fb6001280b600 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000008802ae008000000048000000000000000000000009000000020000004403ae00010000003900000001000000c8bf8f0000000000eccf8f0710836f748e0d90070a000000000000003600000000000000010000000000004836000000983f9007410001010a000000983f90070000000048bb8f0739000039ef000000ff0300000000ae00a8b88f0700000000e0c3ae0048c08f0000aeae000e0212000e0212006002ae00e0c08f008357b97712aeae00d054b977a757b977ffffffff987880574f8c6244bb6371042380b10900000000008c624450a0a174000000000000000000000000ffffffff0000000000000000000000000eba8f0726ba8f07 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000008802ae008000000048000000000000000000000009000000020000004403ae00010000003900000001000000c8bf8f0000000000eccf8f0710836f748e0d90070a000000000000003600000000000000010000000000004836000000983f9007410001010a000000983f90070000000048bb8f0739000039ef000000ff0300000000ae00a8b88f0700000000e0c3ae0048c08f0000aeae000e0212000e0212006002ae00e0c08f008357b97712aeae00d054b977a757b977ffffffff987880574f8c6244bb6371042380b10900000000008c624450a0a174000000000000000000000000ffffffff0000000000000000000000005eadb00074adb000 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000008802ae008000000048000000000000000000000009000000020000004403ae00010000003900000001000000c8bf8f0000000000eccf8f0710836f748e0d90070a000000000000003600000000000000010000000000004836000000983f9007410001010a000000983f90070000000048bb8f0739000039ef000000ff0300000000ae00a8b88f0700000000e0c3ae0048c08f0000aeae000e0212000e0212006002ae00e0c08f008357b97712aeae00d054b977a757b977ffffffff987880574f8c6244bb6371042380b10900000000008c624450a0a174000000000000000000000000ffffffff0000000000000000000000003e2cb700562cb700 (UID: 00000000-00002088)33:Tbeb,Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "9001816114,7236,110,,EnumWindows,user32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8935828099,7236,105,,GetForegroundWindow,user32.dll,"00:30:37.796",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8962820831,7236,107,,GetActiveWindow,user32.dll,"00:30:37.812",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8859129467,7236,105,,GetForegroundWindow,user32.dll,"00:30:37.765",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8808617045,7236,105,,GetForegroundWindow,user32.dll,"00:30:37.750",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8909514078,7236,105,,GetForegroundWindow,user32.dll,"00:30:37.781",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp")34:T573,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "function GetVersionComponents(const Filename: String; var Major, Minor, Revision, Build: Word): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp")35:Te4e,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queries volume information of an entire harddrive"C:\" at 00000000-00002088-00000C17-828470078 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" queries volume information of an entire harddrive"C:\" at 00000000-00002088-00000C17-828610880 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00001236-00000C17-837112334 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00001236-00000C17-837115182 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00001236-00000C17-837122068 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00001236-00000C17-837129751 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00001236-00000C17-837130444 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00001236-00000C17-837131102 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets" at 00000000-00001236-00000C17-837133815 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\OPCG Online\logs\active_session.json" at 00000000-00001236-00000C17-838178020 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\OPCG Online\OPCG Online\shared_preferences.json" at 00000000-00001236-00000C17-838178249 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\OPCG Online\logs\opcg_safety.log" at 00000000-00001236-00000C17-838178609 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\OPCG Online\OPCG Online\shared_preferences.json" at 00000000-00001236-00000C17-838178999 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\OPCG Online\logs\opcg_safety.log" at 00000000-00001236-00000C17-838309242 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00005348-00000C17-837053120 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00005348-00000C17-837055927 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00005348-00000C17-837062259 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00005348-00000C17-837088286 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00005348-00000C17-837088987 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\app.so" at 00000000-00005348-00000C17-837089650 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\data\flutter_assets" at 00000000-00005348-00000C17-837133541 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\OPCG Online\logs\opcg_safety.log" at 00000000-00005348-00000C17-838657897 "opcg_online.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\OPCG Online\logs\opcg_safety.log" at 00000000-00005348-00000C17-83865898536:T4ef,"opcg_online.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "opcg_online.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB")37:T122c,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "CreateDirectoryW" with parameter %TEMP%\is-HU6IX5YFB0.tmp (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-85FC4VKCEM.tmp (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-85FC4VKCEM.tmp\_isetup (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\localization (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\other (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\other\small (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\navigation (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\updater (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\fonts (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\shaders (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\OPCG Online (UID: 00000000-00002088) "opcg_online.exe" called "CreateDirectoryW" with parameter \\?\%LOCALAPPDATA%\OPCG Online\logs (UID: 00000000-00001236) "opcg_online.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\OPCG Online\OPCG Online (UID: 00000000-00001236) "opcg_online.exe" called "CreateDirectoryW" with parameter \\?\%LOCALAPPDATA%\OPCG Online (UID: 00000000-00005348) "opcg_online.exe" called "CreateDirectoryW" with parameter \\?\%LOCALAPPDATA%\OPCG Online\logs (UID: 00000000-00005348)38:T18c0,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00002088) "opcg_online.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter dcomp.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter ComBase.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter coremessaging.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter DWriteCore.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter d3dcompiler_47.dll (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00001236) "opcg_online.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter dcomp.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter ComBase.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter coremessaging.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter DWriteCore.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter d3dcompiler_47.dll (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00005348) "opcg_online.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005348)39:T1b37,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-1LR7U5K4I3.tmp & %LOCALAPPDATA%\Programs\OPCG Online\unins000.exe (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-MT44135ELJ.tmp & %LOCALAPPDATA%\Programs\OPCG Online\desktop_drop_plugin.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-U7ESQDXKLZ.tmp & %LOCALAPPDATA%\Programs\OPCG Online\emoji_picker_flutter_plugin.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-PFKHS2C70Y.tmp & %LOCALAPPDATA%\Programs\OPCG Online\file_selector_windows_plugin.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-NUNLJ1G776.tmp & %LOCALAPPDATA%\Programs\OPCG Online\flutter_secure_storage_windows_plugin.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-XUTMEOLQIU.tmp & %LOCALAPPDATA%\Programs\OPCG Online\flutter_windows.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-1KSJHKZRY8.tmp & %LOCALAPPDATA%\Programs\OPCG Online\opcg_online.exe (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\is-A8UG3JXWTF.tmp & %LOCALAPPDATA%\Programs\OPCG Online\url_launcher_windows_plugin.dll (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\is-1T0ZXBRO12.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\app.so (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\is-1M2SXJ3O98.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\icudtl.dat (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-7ZO9TWMIMB.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\AssetManifest.bin (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-MPWW7FKRSL.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\FontManifest.json (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-HM295PBWE8.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\NativeAssetsManifest.json (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-37NLDM14GH.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\NOTICES.Z (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-KTHKMVSC4R.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-Bold.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-0XIC5ZGQH4.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-BoldItalic.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-GL3CZNE200.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-Italic.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FI9D0P02XK.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-OFL.txt (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-H6HSH8WC8R.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Arimo-Regular.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-HB8O2B3YW1.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\BodoniModa-OFL.txt (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-EMJVXWXHVV.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\BodoniModa.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-VYELM2CN3Q.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-Bold.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FA91LXFA4T.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-BoldItalic.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-BVEO9B5ZXV.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-Italic.ttf (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "MoveFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-CLBU2HPI1S.tmp & %LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\Tinos-OFL.txt (UID: 00000000-00002088)3a:T9bb8,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SetProcessMitigationPolicy (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SHGetStockIconInfo (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SHGetImageList (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00002088) "opcg_online.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetPointerType (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter SetWindowCompositionAttribute (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter D3D11CreateDevice (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter WindowsCompareStringOrdinal (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CreateDispatcherQueueController (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter DWriteCoreCreateFactory (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter DwmGetCompositionTimingInfo (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter D3DCompile (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter D3DDisassemble (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001236) "opcg_online.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetPointerType (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter SetWindowCompositionAttribute (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter D3D11CreateDevice (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter WindowsCompareStringOrdinal (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CreateDispatcherQueueController (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter DWriteCoreCreateFactory (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter DwmGetCompositionTimingInfo (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter D3DCompile (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter D3DDisassemble (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00005348) "opcg_online.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005348)3b:T407,Sleep@KERNEL32.DLL at 00000000-00004780-20076-112-00CF3EB8 Sleep@KERNEL32.DLL at 00000000-00004780-20076-113-00CF3C14 Sleep@KERNEL32.DLL at 00000000-00004780-20076-117-00CF423C Sleep@KERNEL32.DLL at 00000000-00004780-20076-209-00CF6CC4 Sleep@KERNEL32.DLL at 00000000-00004780-20076-214-00CF677C Sleep@KERNEL32.DLL at 00000000-00004780-20076-269-00CF4434 Sleep@KERNEL32.DLL at 00000000-00004780-20076-2640-00CF4A64 WaitForSingleObject@KERNEL32.DLL at 00000000-00004780-20076-2980-00D2B86C Sleep@KERNEL32.DLL at 00000000-00004780-20076-2992-00D888F4 WaitForSingleObject@KERNEL32.DLL at 00000000-00004780-20076-3486-00D87BCC Sleep@KERNEL32.DLL at 00000000-00004780-20076-3728-00D994F8 MsgWaitForMultipleObjects at 00000000-00004780-20076-3745-00D99F84 WaitForSingleObject@KERNEL32.DLL at 00000000-00004780-20076-3949-00D1422A Sleep@KERNEL32.DLL at 00000000-00004780-20076-3955-00D14358 WaitForSingleObject@KERNEL32.DLL at 00000000-00004780-20076-3956-00D14220 Sleep@KERNEL32.DLL at 00000000-00004780-20076-5990-00D13DFD3c:T16bd4,Found reference to API (Indicator: "EqualSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegCloseKey"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FreeSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateEventW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TlsSetValue"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetProcAddress"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FindClose"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCPInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SuspendThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTickCount"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VirtualProtect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateProcessW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "HeapAlloc"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LCMapStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateFileW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetStdHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ReadFile"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FindResourceW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ResetEvent"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RaiseException"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetACP"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "HeapDestroy"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetEvent"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ExitThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "Sleep"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLastError"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadResource"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetLastError"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VirtualFree"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SwitchToThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LocalFree"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLocalTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "HeapCreate"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CloseHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FreeLibrary"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetVersionExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTempPathW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsValidLocale"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FormatMessageW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCPInfoExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SizeofResource"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LocalAlloc"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TlsGetValue"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DeleteFileW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "HeapFree"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "lstrlenW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ResumeThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VirtualQuery"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CompareStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetVersion"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RtlUnwind"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LockResource"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ExitProcess"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WriteFile"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VariantChangeType"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SysFreeString"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VariantClear"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VariantInit"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VariantCopy"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CharUpperW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TranslateMessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CharNextW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MessageBoxW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "PeekMessageW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DestroyWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CharLowerBuffW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetThreadUILanguage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTickCount64"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCurrentDirectory"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WTSRegisterSessionNotification"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegUnLoadKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegSaveKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetUserNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegReplaceKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegConnectRegistryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegRestoreKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegFlushKey"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegLoadKeyW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DeleteObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetStockObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RoundRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDIBits"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DeleteDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BitBlt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "StretchBlt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetObjectW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetDIBits"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SelectObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FindNextFileW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalLock"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetProfileStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreatePipe"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FormatMessageA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TerminateProcess"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CompareFileTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WriteProfileStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OpenMutexW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetErrorMode"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MoveFileExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OpenProcess"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MoveFileW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetFilePointer"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "lstrcmpW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CopyFileW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetFileTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TerminateThread"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FreeResource"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalFree"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateMutexW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TransactNamedPipe"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MulDiv"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WNetCloseEnum"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WNetOpenEnumW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WNetEnumResourceW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OleUninitialize"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OleInitialize"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsEqualGUID"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CoUninitialize"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CoInitialize"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CoDisconnectObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetActiveObject"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadIconW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetClipboardData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCursorPos"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetParent"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ScreenToClient"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DrawIcon"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DestroyIcon"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnableWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetCursor"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InsertMenuW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateIcon"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCursor"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ReleaseDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DestroyMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetScrollPos"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CopyIcon"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FillRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "UpdateWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindowDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CharLowerW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadCursorW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnableScrollBar"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetKeyState"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetClientRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DeleteMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetIconInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateIconIndirect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetCapture"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSysColor"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DestroyCursor"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MessageBeep"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetMenuState"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "HideCaret"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetTopWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DrawIconEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsChild"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegisterClassW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnumWindows"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ClientToScreen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetScrollRange"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ScrollWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ShowOwnedPopups"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "FrameRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SendMessageA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetScrollPos"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BeginPaint"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OpenClipboard"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetParent"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "LoadImageW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AppendMenuW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CharToOemBuffA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetKeyNameTextW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetClipboardData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RedrawWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ShowCaret"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetCursorPos"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetTimer"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RemoveMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetWindowPos"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WaitMessage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetDCEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CloseClipboard"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "KillTimer"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "MoveWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetFocus"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetFocus"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OffsetRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetWindowRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetCapture"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsIconic"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetScrollRange"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CopyImage"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InflateRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DrawEdge"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OemToCharBuffA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetSubMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "PeekMessageA"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ShowWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InvalidateRect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "IsZoomed"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CreateMenu"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpSetStatusCallback"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpWriteData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpSetOption"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpSetCredentials"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpQueryOption"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CredFree"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CredEnumerateW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptSetProperty"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptEncrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptGetProperty"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptDecrypt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "RegGetValueW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AllocConsole"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "AttachConsole"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "StrToInt64ExW"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "CredEnumerateW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "CredFree"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00001236.00000001.119792.9568F000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001236.00000001.119792.9568F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001236.00000001.119792.9568F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001236.00000001.119792.9568F000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001236.00000001.119792.95972000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001236.00000001.119792.95972000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00001236.00000001.119792.99F9E000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found reference to API (Indicator: "WNetEnumResourceW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "WNetGetUniversalNameW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "WNetCloseEnum"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "WNetOpenEnumW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "OemToCharBuffA"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CharToOemBuffA"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformationForYear"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CryptDecodeObject"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertNameToStrW"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertFindChainInStore"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp")3d:T842,"Software\Embarcadero\Locales" in Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe "Software\CodeGear\Locales" in Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe "Software\Borland\Locales" in Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe "Software\Borland\Delphi\Locales" in Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001236.00000001.119792.046FF000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00002088.00000000.116613.05000000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00002088.00000001.117636.008EC000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002088.00000001.117636.008EC000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002088.00000001.117636.00AE0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002088.00000001.117636.00B02000.00000004.mdmp3e:T1494,Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2088:168:WilStaging_02" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2088:168:WilStaging_02" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2088:64:WilError_01" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "Local\SM0:2088:168:WilStaging_02" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000"3f:T466,Antivirus vendors marked dropped file "is-XUTMEOLQIU.tmp" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "is-NUNLJ1G776.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "is-1KSJHKZRY8.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "is-PFKHS2C70Y.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "is-A8UG3JXWTF.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "is-MT44135ELJ.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "is-U7ESQDXKLZ.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_setup64.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections")40:T607,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-1LR7U5K4I3.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-NUNLJ1G776.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-1KSJHKZRY8.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-PFKHS2C70Y.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-A8UG3JXWTF.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-MT44135ELJ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-U7ESQDXKLZ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT41:Tb9f,"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001236.00000001.119792.046FF000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00002088.00000000.116613.00AE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00002088.00000000.116613.05000000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00002088.00000001.117636.008EC000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002088.00000001.117636.008EC000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002088.00000001.117636.00AE0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002088.00000001.117636.00B02000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002088.00000001.117636.078F0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002088.00000001.117636.078F0000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00004780.00000001.117653.00CF1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00004780.00000001.117653.00CF1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00004780.00000001.117653.00CF1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00004780.00000001.117653.00CF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004780.00000001.117653.00CF1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005348.00000000.117875.046FF000.00000002.mdmp "y\Machine\Software\ClassH" in Source: 00000000-00005348.00000000.117875.FD380000.00000004.mdmp "y\Machine\Software\ClassH" in Source: 00000000-00005348.00000001.119796.FD380000.00000004.mdmp42:T23dd,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744b0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "KERNEL32.DLL" at base 77b60000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 74490000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75700000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "RPCRT4.DLL" at base 75f50000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74410000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "NTDLL.DLL" at base 77c30000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74340000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 744b0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "KERNEL32.DLL" at base 77b60000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "MSCTF.DLL" at base 75810000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "IMM32.DLL" at base 749e0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74410000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73f80000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "NTDLL.DLL" at base 77c30000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "RPCRT4.DLL" at base 75f50000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "UXTHEME.DLL" at base 74410000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76620000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 74490000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75700000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73db0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 73d80000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "COMCTL32" at base 74060000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "USER32.DLL" at base 75100000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "COMCTL32.DLL" at base 74060000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "SHELL32.DLL" at base 76620000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 73ce0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 73e10000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "OLEAUT32.DLL" at base 76020000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75100000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75100000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74670000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75810000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "DWMAPI.DLL" at base 743e0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "MSIMG32.DLL" at base 737a0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 761f0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "SSPICLI.DLL" at base 74650000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 73300000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 5de0000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74a10000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73160000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74a10000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "CSCAPI.DLL" at base 73050000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74340000 "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 743e0000 "opcg_online.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff985440000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9ac8d0000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ff9a1b40000 "opcg_online.exe" loaded module "USER32.DLL" at base 7ff9af560000 "opcg_online.exe" loaded module "SHCORE.DLL" at base 7ff9afab0000 "opcg_online.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ff9acd30000 "opcg_online.exe" loaded module "RPCRT4.DLL" at base 285e9ae0000 "opcg_online.exe" loaded module "GDI32.DLL" at base 285e9930000 "opcg_online.exe" loaded module "D3D11.DLL" at base 7ff9ab760000 "opcg_online.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff9ae330000 "opcg_online.exe" loaded module "DCOMP.DLL" at base 7ff9ac160000 "opcg_online.exe" loaded module "D3D10WARP.DLL" at base 7ff9a81b0000 "opcg_online.exe" loaded module "COMBASE.DLL" at base 7ff9b1c10000 "opcg_online.exe" loaded module "COREMESSAGING.DLL" at base 7ff9ac010000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff9a9f50000 "opcg_online.exe" loaded module "KERNEL32.DLL" at base 7ff9b1b40000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ff99ca00000 "opcg_online.exe" loaded module "DWMAPI.DLL" at base 7ff9acd60000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9af380000 "opcg_online.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 7ff9aede0000 "opcg_online.exe" loaded module "DBGHELP.DLL" at base 7ff9a6410000 "opcg_online.exe" loaded module "DWRITE.DLL" at base 7ff99d250000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff997b20000 "opcg_online.exe" loaded module "OLEAUT32.DLL" at base 7ff9b15c0000 "opcg_online.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff9af560000 "opcg_online.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff9af560000 "opcg_online.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff9b1c10000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff9b10b0000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff9b1470000 "opcg_online.exe" loaded module "OLE32.DLL" at base 7ff9b1470000 "opcg_online.exe" loaded module "SHELL32.DLL" at base 7ff9afb60000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9adb30000 "opcg_online.exe" loaded module "VERSION.DLL" at base 7ff9a61b0000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff9a71e0000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9a6c70000 "opcg_online.exe" loaded module "WSHTCPIP" at base 7ff9a51e0000 "opcg_online.exe" loaded module "WSHIP6.DLL" at base 7ff9a51d0000 "opcg_online.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 7ff9a51f0000 "opcg_online.exe" loaded module "D3DCOMPILER_47.DLL" at base 7ff9ab330000 "opcg_online.exe" loaded module "BCRYPTPRIMITIVES" at base 7ff9af380000 "opcg_online.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ff9aede0000 "opcg_online.exe" loaded module "RPCRT4.DLL" at base 7ff9af800000 "opcg_online.exe" loaded module "GDI32.DLL" at base 7ff9b1ae000043:Td80,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" was detected as "Inno Setup Module" and name: "Installer" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" was detected as ".NET Reactor" and name: "Protector" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" was detected as "Turbo Linker" and name: "Linker" "is-1LR7U5K4I3.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1LR7U5K4I3.tmp" was detected as ".NET Reactor" and name: "Protector" "is-1LR7U5K4I3.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-1LR7U5K4I3.tmp" was detected as "Turbo Linker" and name: "Linker" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" was detected as "Inno Setup Module" and name: "Installer" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" was detected as ".NET Reactor" and name: "Protector" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" was detected as "Turbo Linker" and name: "Linker" "is-NUNLJ1G776.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-NUNLJ1G776.tmp" was detected as ".NET Reactor" and name: "Protector" "is-NUNLJ1G776.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-NUNLJ1G776.tmp" was detected as "Turbo Linker" and name: "Linker" "is-1KSJHKZRY8.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1KSJHKZRY8.tmp" was detected as ".NET Reactor" and name: "Protector" "is-1KSJHKZRY8.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-1KSJHKZRY8.tmp" was detected as "Turbo Linker" and name: "Linker" "is-PFKHS2C70Y.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-PFKHS2C70Y.tmp" was detected as ".NET Reactor" and name: "Protector" "is-PFKHS2C70Y.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-PFKHS2C70Y.tmp" was detected as "Turbo Linker" and name: "Linker" "is-A8UG3JXWTF.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-A8UG3JXWTF.tmp" was detected as ".NET Reactor" and name: "Protector" "is-A8UG3JXWTF.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-A8UG3JXWTF.tmp" was detected as "Turbo Linker" and name: "Linker" "is-MT44135ELJ.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-MT44135ELJ.tmp" was detected as ".NET Reactor" and name: "Protector" "is-MT44135ELJ.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-MT44135ELJ.tmp" was detected as "Turbo Linker" and name: "Linker" "is-U7ESQDXKLZ.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-U7ESQDXKLZ.tmp" was detected as ".NET Reactor" and name: "Protector" "is-U7ESQDXKLZ.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-U7ESQDXKLZ.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as ".NET Reactor" and name: "Protector" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"44:T73e,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Shared Bitmap Object" (Path: "HKCU\WOW6432NODE\CLSID\{4DB26476-6787-4046-B836-E8412A9E8A27}\TREATAS") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS")45:T552,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "opcg_online.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "opcg_online.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")46:T993c,"is-XUTMEOLQIU.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-XUTMEOLQIU.tmp]- [targetUID: 00000000-00002088] "is-1T0ZXBRO12.tmp" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 17744752"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\is-1T0ZXBRO12.tmp]- [targetUID: 00000000-00002088] "is-1LR7U5K4I3.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1LR7U5K4I3.tmp]- [targetUID: 00000000-00002088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp]- [targetUID: 00000000-00002088] "is-6JB3DA16U1.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\fonts\is-6JB3DA16U1.tmp]- [targetUID: 00000000-00002088] "is-1M2SXJ3O98.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\is-1M2SXJ3O98.tmp]- [targetUID: 00000000-00002088] "is-VYELM2CN3Q.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-VYELM2CN3Q.tmp]- [targetUID: 00000000-00002088] "is-FA91LXFA4T.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FA91LXFA4T.tmp]- [targetUID: 00000000-00002088] "is-BVEO9B5ZXV.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-BVEO9B5ZXV.tmp]- [targetUID: 00000000-00002088] "is-DWDHSWL6JI.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-DWDHSWL6JI.tmp]- [targetUID: 00000000-00002088] "is-0XIC5ZGQH4.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-0XIC5ZGQH4.tmp]- [targetUID: 00000000-00002088] "is-GL3CZNE200.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-GL3CZNE200.tmp]- [targetUID: 00000000-00002088] "is-KTHKMVSC4R.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-KTHKMVSC4R.tmp]- [targetUID: 00000000-00002088] "is-H6HSH8WC8R.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-H6HSH8WC8R.tmp]- [targetUID: 00000000-00002088] "is-VT8RNW2SQQ.tmp" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1058x1487 components 3"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-VT8RNW2SQQ.tmp]- [targetUID: 00000000-00002088] "is-4TNMBWMI6Q.tmp" has type "RIFF (little-endian) data Web/P image VP8 encoding 1000x1410 Scaling: [none]x[none] YUV color decoders should clamp"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-4TNMBWMI6Q.tmp]- [targetUID: 00000000-00002088] "is-EMJVXWXHVV.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-EMJVXWXHVV.tmp]- [targetUID: 00000000-00002088] "is-NUNLJ1G776.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-NUNLJ1G776.tmp]- [targetUID: 00000000-00002088] "is-1KSJHKZRY8.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1KSJHKZRY8.tmp]- [targetUID: 00000000-00002088] "is-PFKHS2C70Y.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-PFKHS2C70Y.tmp]- [targetUID: 00000000-00002088] "is-37NLDM14GH.tmp" has type "gzip compressed data max compression from TOPS/20 original size modulo 2^32 1416969"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-37NLDM14GH.tmp]- [targetUID: 00000000-00002088] "is-A8UG3JXWTF.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-A8UG3JXWTF.tmp]- [targetUID: 00000000-00002088] "is-MT44135ELJ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-MT44135ELJ.tmp]- [targetUID: 00000000-00002088] "is-E3I9PRQ53X.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\localization\is-E3I9PRQ53X.tmp]- [targetUID: 00000000-00002088] "is-U7ESQDXKLZ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-U7ESQDXKLZ.tmp]- [targetUID: 00000000-00002088] "is-OYYQF5ZECP.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-OYYQF5ZECP.tmp]- [targetUID: 00000000-00002088] "is-IUOGA1DJ52.tmp" has type "PNG image data 256 x 256 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\navigation\is-IUOGA1DJ52.tmp]- [targetUID: 00000000-00002088] "is-5MKUGY4LB0.tmp" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 220x307 components 3"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\other\small\is-5MKUGY4LB0.tmp]- [targetUID: 00000000-00002088] "is-6A1FDS6Q4E.tmp" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 220x307 components 3"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\other\small\is-6A1FDS6Q4E.tmp]- [targetUID: 00000000-00002088] "is-WR5DK5GZ0Y.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-WR5DK5GZ0Y.tmp]- [targetUID: 00000000-00002088] "is-7ZO9TWMIMB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-7ZO9TWMIMB.tmp]- [targetUID: 00000000-00002088] "is-XWDLDCSEPL.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-XWDLDCSEPL.tmp]- [targetUID: 00000000-00002088] "is-C9PIUQFHTG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-C9PIUQFHTG.tmp]- [targetUID: 00000000-00002088] "is-TKHGDADIRG.tmp" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 220x307 components 3"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\other\small\is-TKHGDADIRG.tmp]- [targetUID: 00000000-00002088] "is-IN615IL5XU.tmp" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 220x307 components 3"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\other\small\is-IN615IL5XU.tmp]- [targetUID: 00000000-00002088] "is-NKVR0KERTK.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-NKVR0KERTK.tmp]- [targetUID: 00000000-00002088] "is-92TTPEB19O.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-92TTPEB19O.tmp]- [targetUID: 00000000-00002088] "is-6QJ24L5L0D.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-6QJ24L5L0D.tmp]- [targetUID: 00000000-00002088] "is-7XK5XTX4PT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-7XK5XTX4PT.tmp]- [targetUID: 00000000-00002088] "is-0VRXNFC62G.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-0VRXNFC62G.tmp]- [targetUID: 00000000-00002088] "is-4EODZHO683.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-4EODZHO683.tmp]- [targetUID: 00000000-00002088] "is-MBB80C1GFQ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-MBB80C1GFQ.tmp]- [targetUID: 00000000-00002088] "is-5NJTFKMX7D.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-5NJTFKMX7D.tmp]- [targetUID: 00000000-00002088] "is-W2PNFBRH47.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-W2PNFBRH47.tmp]- [targetUID: 00000000-00002088] "is-8SOIQDEYX9.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8SOIQDEYX9.tmp]- [targetUID: 00000000-00002088] "is-IEXQITLOFF.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-IEXQITLOFF.tmp]- [targetUID: 00000000-00002088] "is-O1C1KJB3MK.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-O1C1KJB3MK.tmp]- [targetUID: 00000000-00002088] "is-5XMF3ROYJV.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-5XMF3ROYJV.tmp]- [targetUID: 00000000-00002088] "is-1HYC91S6ZC.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-1HYC91S6ZC.tmp]- [targetUID: 00000000-00002088] "is-ZYPM9HKANZ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ZYPM9HKANZ.tmp]- [targetUID: 00000000-00002088] "is-TT1CZXZ9GB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-TT1CZXZ9GB.tmp]- [targetUID: 00000000-00002088] "is-LZ67GZT1RT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\updater\is-LZ67GZT1RT.tmp]- [targetUID: 00000000-00002088] "is-IAFPD1DJFL.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-IAFPD1DJFL.tmp]- [targetUID: 00000000-00002088] "is-CD1L03DTVG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-CD1L03DTVG.tmp]- [targetUID: 00000000-00002088] "is-TN9KMQKGW4.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-TN9KMQKGW4.tmp]- [targetUID: 00000000-00002088] "is-6RHX6L2QLI.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-6RHX6L2QLI.tmp]- [targetUID: 00000000-00002088] "is-DGJ7XIBNLP.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-DGJ7XIBNLP.tmp]- [targetUID: 00000000-00002088] "is-V7KX97QGXT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-V7KX97QGXT.tmp]- [targetUID: 00000000-00002088] "is-MZZWQTNTOW.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-MZZWQTNTOW.tmp]- [targetUID: 00000000-00002088] "is-57XBP8IE4K.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-57XBP8IE4K.tmp]- [targetUID: 00000000-00002088] "is-2B9C8WQ9TF.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2B9C8WQ9TF.tmp]- [targetUID: 00000000-00002088] "is-55X0DU0E6J.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-55X0DU0E6J.tmp]- [targetUID: 00000000-00002088] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-85FC4VKCEM.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002088] "is-PE7E9PLS3H.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-PE7E9PLS3H.tmp]- [targetUID: 00000000-00002088] "is-PYQ8N9Y127.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-PYQ8N9Y127.tmp]- [targetUID: 00000000-00002088] "is-37YJ62GGXT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-37YJ62GGXT.tmp]- [targetUID: 00000000-00002088] "is-40231KCGN8.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-40231KCGN8.tmp]- [targetUID: 00000000-00002088] "is-ILT06S3BIW.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ILT06S3BIW.tmp]- [targetUID: 00000000-00002088] "is-20TR7TJHEG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-20TR7TJHEG.tmp]- [targetUID: 00000000-00002088] "is-BJYQN8QIAJ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-BJYQN8QIAJ.tmp]- [targetUID: 00000000-00002088] "is-TYMAI2ZVCB.tmp" has type "PNG image data 64 x 72 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-TYMAI2ZVCB.tmp]- [targetUID: 00000000-00002088] "is-M38I7V7Q6S.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-M38I7V7Q6S.tmp]- [targetUID: 00000000-00002088] "is-76ZEODJPVM.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-76ZEODJPVM.tmp]- [targetUID: 00000000-00002088] "is-C7F6RSTWMK.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-C7F6RSTWMK.tmp]- [targetUID: 00000000-00002088] "is-HB8O2B3YW1.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-HB8O2B3YW1.tmp]- [targetUID: 00000000-00002088] "is-FI9D0P02XK.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FI9D0P02XK.tmp]- [targetUID: 00000000-00002088] "is-CLBU2HPI1S.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-CLBU2HPI1S.tmp]- [targetUID: 00000000-00002088] "is-WTZ3GUXL6D.tmp" has type "PNG image data 64 x 72 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-WTZ3GUXL6D.tmp]- [targetUID: 00000000-00002088] "is-VS2ZZNL0AS.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VS2ZZNL0AS.tmp]- [targetUID: 00000000-00002088] "is-OH8V6DVR1Z.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-OH8V6DVR1Z.tmp]- [targetUID: 00000000-00002088] "is-ABSC9W9NVL.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ABSC9W9NVL.tmp]- [targetUID: 00000000-00002088] "is-5BDE10VMSQ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-5BDE10VMSQ.tmp]- [targetUID: 00000000-00002088] "is-AQ0UZN7AV0.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-AQ0UZN7AV0.tmp]- [targetUID: 00000000-00002088] "is-ZKBE9NOJ7K.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ZKBE9NOJ7K.tmp]- [targetUID: 00000000-00002088] "is-KRERHPY4TZ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-KRERHPY4TZ.tmp]- [targetUID: 00000000-00002088] "is-WT3JGHSQYS.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-WT3JGHSQYS.tmp]- [targetUID: 00000000-00002088] "is-SQZKKTGL6Z.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-SQZKKTGL6Z.tmp]- [targetUID: 00000000-00002088] "is-ASVLK82ATG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ASVLK82ATG.tmp]- [targetUID: 00000000-00002088] "is-GNQ3WR5N1J.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-GNQ3WR5N1J.tmp]- [targetUID: 00000000-00002088] "is-HRSZKFZELT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-HRSZKFZELT.tmp]- [targetUID: 00000000-00002088] "is-XQXQAGR3KB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-XQXQAGR3KB.tmp]- [targetUID: 00000000-00002088] "is-RRGG1UL15H.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-RRGG1UL15H.tmp]- [targetUID: 00000000-00002088] "is-MKIZWXHRZJ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-MKIZWXHRZJ.tmp]- [targetUID: 00000000-00002088] "is-RLJ3WO2VON.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-RLJ3WO2VON.tmp]- [targetUID: 00000000-00002088] "is-SX4N85VXAB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-SX4N85VXAB.tmp]- [targetUID: 00000000-00002088] "is-FWUVTTICLQ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-FWUVTTICLQ.tmp]- [targetUID: 00000000-00002088] "is-E1NE7ZZMIU.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-E1NE7ZZMIU.tmp]- [targetUID: 00000000-00002088] "is-2878UTFAC8.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2878UTFAC8.tmp]- [targetUID: 00000000-00002088] "is-EKW5MPXGPZ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-EKW5MPXGPZ.tmp]- [targetUID: 00000000-00002088] "is-BLDPJE641H.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-BLDPJE641H.tmp]- [targetUID: 00000000-00002088] "is-IWVRE6F1PH.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-IWVRE6F1PH.tmp]- [targetUID: 00000000-00002088] "is-3LT3FKOUYE.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-3LT3FKOUYE.tmp]- [targetUID: 00000000-00002088] "is-B8R2I0FPEF.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-B8R2I0FPEF.tmp]- [targetUID: 00000000-00002088] "is-8UPI99IC3V.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8UPI99IC3V.tmp]- [targetUID: 00000000-00002088] "is-0E54AWK2QD.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-0E54AWK2QD.tmp]- [targetUID: 00000000-00002088] "is-RY7SA8VQVR.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-RY7SA8VQVR.tmp]- [targetUID: 00000000-00002088] "is-ERLKH8KBEI.tmp" has type "PNG image data 64 x 72 8-bit colormap non-interlaced"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-ERLKH8KBEI.tmp]- [targetUID: 00000000-00002088] "is-J416Y8WWMS.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-J416Y8WWMS.tmp]- [targetUID: 00000000-00002088] "is-FXVLBC6872.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-FXVLBC6872.tmp]- [targetUID: 00000000-00002088] "is-JD3F0VU9B5.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-JD3F0VU9B5.tmp]- [targetUID: 00000000-00002088] "is-RAOD69J4EZ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-RAOD69J4EZ.tmp]- [targetUID: 00000000-00002088] "is-2WEU7XC3TM.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2WEU7XC3TM.tmp]- [targetUID: 00000000-00002088] "is-8E08HP5D3J.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8E08HP5D3J.tmp]- [targetUID: 00000000-00002088] "is-X43MLRGMEK.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-X43MLRGMEK.tmp]- [targetUID: 00000000-00002088] "is-BV43NU5JZT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-BV43NU5JZT.tmp]- [targetUID: 00000000-00002088] "is-0EMI83INLB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-0EMI83INLB.tmp]- [targetUID: 00000000-00002088] "is-8PZ1IOMZDH.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8PZ1IOMZDH.tmp]- [targetUID: 00000000-00002088] "is-WGTEFB2UPD.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-WGTEFB2UPD.tmp]- [targetUID: 00000000-00002088] "is-CXCLICKTP3.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-CXCLICKTP3.tmp]- [targetUID: 00000000-00002088] "is-NF3D3SL3IE.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-NF3D3SL3IE.tmp]- [targetUID: 00000000-00002088] "is-O2WDGFCEU4.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-O2WDGFCEU4.tmp]- [targetUID: 00000000-00002088] "is-2J6QVC8FLO.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2J6QVC8FLO.tmp]- [targetUID: 00000000-00002088] "is-JXLPHVM331.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-JXLPHVM331.tmp]- [targetUID: 00000000-00002088] "is-2SMEGZPQET.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2SMEGZPQET.tmp]- [targetUID: 00000000-00002088] "is-0HCTPG8FDW.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-0HCTPG8FDW.tmp]- [targetUID: 00000000-00002088] "is-Q6994COZDM.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-Q6994COZDM.tmp]- [targetUID: 00000000-00002088] "is-1FWGUCTTG0.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-1FWGUCTTG0.tmp]- [targetUID: 00000000-00002088] "is-P84EWQB5PY.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-P84EWQB5PY.tmp]- [targetUID: 00000000-00002088] "is-VJOLILO3OI.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VJOLILO3OI.tmp]- [targetUID: 00000000-00002088] "is-2ZV1AC9EQI.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2ZV1AC9EQI.tmp]- [targetUID: 00000000-00002088] "is-PP4U7EPETI.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-PP4U7EPETI.tmp]- [targetUID: 00000000-00002088] "is-9XPKSYUAE9.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-9XPKSYUAE9.tmp]- [targetUID: 00000000-00002088] "is-VCVPMKVQHI.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VCVPMKVQHI.tmp]- [targetUID: 00000000-00002088] "is-AB6P5F1PV1.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-AB6P5F1PV1.tmp]- [targetUID: 00000000-00002088] "is-300CL4JHJB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-300CL4JHJB.tmp]- [targetUID: 00000000-00002088] "is-VRYDCEDBCV.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VRYDCEDBCV.tmp]- [targetUID: 00000000-00002088] "is-41X7B484AN.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-41X7B484AN.tmp]- [targetUID: 00000000-00002088] "is-FBGOWJ5CHU.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-FBGOWJ5CHU.tmp]- [targetUID: 00000000-00002088] "is-ESIJZFUA8A.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ESIJZFUA8A.tmp]- [targetUID: 00000000-00002088] "is-BSNZ1MEFHW.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-BSNZ1MEFHW.tmp]- [targetUID: 00000000-00002088] "is-J4B70AOD7Q.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-J4B70AOD7Q.tmp]- [targetUID: 00000000-00002088] "is-6EW137FONB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-6EW137FONB.tmp]- [targetUID: 00000000-00002088] "is-8H7PLWCI1S.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8H7PLWCI1S.tmp]- [targetUID: 00000000-00002088] "is-MPWW7FKRSL.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-MPWW7FKRSL.tmp]- [targetUID: 00000000-00002088] "is-N1DDE6OLT1.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-N1DDE6OLT1.tmp]- [targetUID: 00000000-00002088] "is-LGQMVW8BW5.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-LGQMVW8BW5.tmp]- [targetUID: 00000000-00002088] "is-QZLA61YQKF.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-QZLA61YQKF.tmp]- [targetUID: 00000000-00002088] "is-GW9WH2BBF0.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-GW9WH2BBF0.tmp]- [targetUID: 00000000-00002088] "is-ASYWM6YK64.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ASYWM6YK64.tmp]- [targetUID: 00000000-00002088] "is-DVDXLBLBWV.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-DVDXLBLBWV.tmp]- [targetUID: 00000000-00002088] "is-IS4K6281PG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-IS4K6281PG.tmp]- [targetUID: 00000000-00002088] "is-4647RSLCM3.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-4647RSLCM3.tmp]- [targetUID: 00000000-00002088] "is-E800QA6ROJ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-E800QA6ROJ.tmp]- [targetUID: 00000000-00002088] "is-5M3046L3NC.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-5M3046L3NC.tmp]- [targetUID: 00000000-00002088] "is-8VF6T10UEE.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8VF6T10UEE.tmp]- [targetUID: 00000000-00002088] "is-N0ESWHYV0L.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-N0ESWHYV0L.tmp]- [targetUID: 00000000-00002088] "is-BVINCNVGVP.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-BVINCNVGVP.tmp]- [targetUID: 00000000-00002088] "is-VA7HERF4QP.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VA7HERF4QP.tmp]- [targetUID: 00000000-00002088] "is-5GIJOIN56O.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-5GIJOIN56O.tmp]- [targetUID: 00000000-00002088] "is-Y5OCAXHQMB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-Y5OCAXHQMB.tmp]- [targetUID: 00000000-00002088] "is-LRTSQXTU24.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-LRTSQXTU24.tmp]- [targetUID: 00000000-00002088] "is-L844CXWD77.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-L844CXWD77.tmp]- [targetUID: 00000000-00002088] "is-MN6J8B2NKD.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-MN6J8B2NKD.tmp]- [targetUID: 00000000-00002088] "is-IZFKB36DCB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-IZFKB36DCB.tmp]- [targetUID: 00000000-00002088] "is-Q8B4IEEJWT.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-Q8B4IEEJWT.tmp]- [targetUID: 00000000-00002088] "is-S03MFAZO1Z.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-S03MFAZO1Z.tmp]- [targetUID: 00000000-00002088] "is-68BNK0MBW8.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-68BNK0MBW8.tmp]- [targetUID: 00000000-00002088] "is-R58TDYOUL5.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-R58TDYOUL5.tmp]- [targetUID: 00000000-00002088] "is-DGEETEK2AO.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-DGEETEK2AO.tmp]- [targetUID: 00000000-00002088] "is-G6I7GYMCB8.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-G6I7GYMCB8.tmp]- [targetUID: 00000000-00002088] "is-8266WFSQ4J.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-8266WFSQ4J.tmp]- [targetUID: 00000000-00002088] "is-16S3VYSREB.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-16S3VYSREB.tmp]- [targetUID: 00000000-00002088] "is-MC9UADSWBR.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-MC9UADSWBR.tmp]- [targetUID: 00000000-00002088] "is-SB9AQU03X5.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-SB9AQU03X5.tmp]- [targetUID: 00000000-00002088] "is-5CALK98BO1.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-5CALK98BO1.tmp]- [targetUID: 00000000-00002088] "is-0SN1UUS8EM.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-0SN1UUS8EM.tmp]- [targetUID: 00000000-00002088] "is-ZIMHTHSTJZ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-ZIMHTHSTJZ.tmp]- [targetUID: 00000000-00002088] "is-GMOYIJOZII.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-GMOYIJOZII.tmp]- [targetUID: 00000000-00002088] "is-KUE9AEMAL6.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-KUE9AEMAL6.tmp]- [targetUID: 00000000-00002088] "is-VSE5MIITPX.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VSE5MIITPX.tmp]- [targetUID: 00000000-00002088] "is-DBQ42OM769.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-DBQ42OM769.tmp]- [targetUID: 00000000-00002088] "is-FTERUPSGZE.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-FTERUPSGZE.tmp]- [targetUID: 00000000-00002088] "is-464KXRIHVA.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-464KXRIHVA.tmp]- [targetUID: 00000000-00002088] "is-Z9QZPEMB77.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-Z9QZPEMB77.tmp]- [targetUID: 00000000-00002088] "is-2I19H1JP7S.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-2I19H1JP7S.tmp]- [targetUID: 00000000-00002088] "is-P9TWTU842C.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-P9TWTU842C.tmp]- [targetUID: 00000000-00002088] "is-UIZK8OJ65Z.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-UIZK8OJ65Z.tmp]- [targetUID: 00000000-00002088] "is-O5V9OWLO2Z.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-O5V9OWLO2Z.tmp]- [targetUID: 00000000-00002088] "is-BNQMSMX2DO.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-BNQMSMX2DO.tmp]- [targetUID: 00000000-00002088] "is-MOQPLCC9MA.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-MOQPLCC9MA.tmp]- [targetUID: 00000000-00002088] "is-JCRY3GZZKF.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-JCRY3GZZKF.tmp]- [targetUID: 00000000-00002088] "is-LJO1J133TG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-LJO1J133TG.tmp]- [targetUID: 00000000-00002088] "is-3VWHDTGDNG.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-3VWHDTGDNG.tmp]- [targetUID: 00000000-00002088] "is-EHPSQ1IKAQ.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-EHPSQ1IKAQ.tmp]- [targetUID: 00000000-00002088] "is-IYZ22PNHPD.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-IYZ22PNHPD.tmp]- [targetUID: 00000000-00002088] "is-HM295PBWE8.tmp" has type "JSON text data"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-HM295PBWE8.tmp]- [targetUID: 00000000-00002088] "is-QCYDNOVSZX.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-QCYDNOVSZX.tmp]- [targetUID: 00000000-00002088] "is-J0IDAS6G59.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-J0IDAS6G59.tmp]- [targetUID: 00000000-00002088] "is-4QHN76KTM7.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-4QHN76KTM7.tmp]- [targetUID: 00000000-00002088] "is-HLERTA48N9.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-HLERTA48N9.tmp]- [targetUID: 00000000-00002088] "is-VL7F1YCRR3.tmp" has type "Unknown"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-VL7F1YCRR3.tmp]- [targetUID: 00000000-00002088]47:T1039,"is-XUTMEOLQIU.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-XUTMEOLQIU.tmp] "is-1T0ZXBRO12.tmp" has type "ELF 64-bit LSB shared object x86-64 version 1 (SYSV) dynamically linked missing section headers at 17744752" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\is-1T0ZXBRO12.tmp] "is-1LR7U5K4I3.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1LR7U5K4I3.tmp] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp] "is-6JB3DA16U1.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\fonts\is-6JB3DA16U1.tmp] "is-1M2SXJ3O98.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\is-1M2SXJ3O98.tmp] "is-VYELM2CN3Q.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-VYELM2CN3Q.tmp] "is-FA91LXFA4T.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FA91LXFA4T.tmp] "is-BVEO9B5ZXV.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-BVEO9B5ZXV.tmp] "is-DWDHSWL6JI.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-DWDHSWL6JI.tmp] "is-0XIC5ZGQH4.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-0XIC5ZGQH4.tmp] "is-GL3CZNE200.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-GL3CZNE200.tmp] "is-KTHKMVSC4R.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-KTHKMVSC4R.tmp] "is-H6HSH8WC8R.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-H6HSH8WC8R.tmp] "is-VT8RNW2SQQ.tmp" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1058x1487 components 3" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-VT8RNW2SQQ.tmp] "is-4TNMBWMI6Q.tmp" has type "RIFF (little-endian) data Web/P image VP8 encoding 1000x1410 Scaling: [none]x[none] YUV color decoders should clamp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-4TNMBWMI6Q.tmp] "is-EMJVXWXHVV.tmp" has type "Unknown" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-EMJVXWXHVV.tmp] "is-NUNLJ1G776.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-NUNLJ1G776.tmp] "is-1KSJHKZRY8.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1KSJHKZRY8.tmp] "is-PFKHS2C70Y.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-PFKHS2C70Y.tmp] "is-37NLDM14GH.tmp" has type "gzip compressed data max compression from TOPS/20 original size modulo 2^32 1416969" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-37NLDM14GH.tmp] "is-A8UG3JXWTF.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-A8UG3JXWTF.tmp] "is-MT44135ELJ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-MT44135ELJ.tmp] "is-E3I9PRQ53X.tmp" has type "JSON text data" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\localization\is-E3I9PRQ53X.tmp] "is-U7ESQDXKLZ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-U7ESQDXKLZ.tmp]48:T77b,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")49:Tfdd,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "044EF3D12EFBAC04A7DBDD40F4E51CD2CDC9C077B0D5D3CB571A2562A74BF9C4.EXE"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "044EF3D12EFBAC04A7DBDD40F4E51CD2CDC9C077B0D5D3CB571A2562A74BF9C4"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")4a:T51b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size4b:T4dc,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "\Device\CNG" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\WINDOWS\SysWOW64\kernelbase.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\WINDOWS\SysWOW64\ole32.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"4c:Tbed,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\MSVCP140.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\MSVCP140.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\VCRUNTIME140.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\VCRUNTIME140.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\CRYPTSP.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\UNINS000.EXE" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\unins000.exe" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\DESKTOP_DROP_PLUGIN.DLL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\desktop_drop_plugin.dll" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\EMOJI_PICKER_FLUTTER_PLUGIN.DLL"4d:Tb84,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-HU6IX5YFB0.TMP" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\044EF3D12EFBAC04A7DBDD40F4E51CD2CDC9C077B0D5D3CB571A2562A74BF9C4.TMP.LOCAL" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp.Local\" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SETUP LOG 2026-10-05 #001.TXT" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Setup Log 2026-10-05 #001.txt" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-85FC4VKCEM.TMP" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-85FC4VKCEM.tmp" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\ICONCACHETODELETE" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG ONLINE" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_PROGRAMS_OPCG_ONLINE_571555FACE1399E5.CDF-MS" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\users_%OSUSER%_appdata_local_programs_opcg_online_571555face1399e5.cdf-ms" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\IS-1LR7U5K4I3.TMP" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-1LR7U5K4I3.tmp"4e:T6e8,Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp")4f:T55c,Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe")50:T41a,Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp")51:Tc83,Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe")52:T249f,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://ninedegreesbelow.com/" Pattern match: "https://github.com/indestructible-type/bodoni" Pattern match: "https://github.com/googlefonts/arimo" Pattern match: "https://github.com/googlefonts/tinos" Heuristic match: "cdn.opcg-online.com" Heuristic match: "get /download/manifest.json http/1.1user-agent: dart/3.11 (dart:io)accept-encoding: gziphost: cdn.opcg-online.com" Heuristic match: "%localappdata%\programs\opcg online\data\app.so" Heuristic match: "\hapubws\appdata\local\programs\opcg online\data\app.so" Heuristic match: ":\users\hapubws\appdata\local\programs\opcg online\data\app.so" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\opcg online\emoji_picker_flutter_plugin.dll.2.co" Heuristic match: "ata\app.so" Heuristic match: "io.flutter.io" Heuristic match: "o.flutter.io" Heuristic match: "e.com" Pattern match: "www.entrust.net/cps" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.digicert.com" Pattern match: "http://crl.startcom.org/sfsca-crl.crl" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "http://cert.startcom.org/sfsca-crl.crl" Heuristic match: "ne.com" Pattern match: "www.entrust.net/legal-terms" Pattern match: "www.digicert.c" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=fvolnxut4pjyixmcqey%2fwahpvcyux2jk1tloe5thqzy%2b2q2uywbh1bpfw2wqo24rgluzejhnczux4o%2fhsxl6gtykv6blwbj2kfpn5rfeil6at9cqzihrasz1wmkfixnuhnu3z4f2" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://crl.comodo.net/aaacertificateservices.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "https://certs.godaddy.com/repository/" Pattern match: "www.entrust.net/cps_2048" Pattern match: "https://www.digicert.com/cps" Heuristic match: "entrust.net" Pattern match: "http://ocsp.digicert.com" Pattern match: "www.digicert.com1/0-" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "crl.microsoft.com/pki/crl/products/microoc" Pattern match: "ft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://certs.godaddy.com/repository/" Pattern match: "http://ocsp.godaddy.com/" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://cdn.opcg-online.com/download/windows/files/dc596f5a29489442e8bd8e56b606fae58b6eaea03074a6927e70efdc89a2621a/data/flutter_assets/packages/twemoji_flags/flags_dist/vn.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/b6fc7cb818ec401b69d180f35eef2eb8471a9bb88cf3988255072bd8681d7f5d/data/flutter_assets/packages/twemoji_flags/flags_dist/vu.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/24374fddc0bb0db523abf2e0e631bcb358a0a9c4a5472047e5e149cc67308145/data/flutter_assets/packages/twemoji_flags/flags_dist/wf.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/4912df913a581e3a63fcf29b32dad383421c2a4fbb54ca30c019e303670326a7/data/flutter_assets/packages/twemoji_flags/flags_dist/ws.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/9b9fb6f333b72d3dd4b86ab614f3653a956fb507ae596efc71f88a3635e425dc/data/flutter_assets/packages/twemoji_flags/flags_dist/xk.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/bf3fd40902fddddfbad40f9164ba5187526fd7f499dc2d7ed00097d0dd1c722a/data/flutter_assets/packages/twemoji_flags/flags_dist/ye.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/396a468ce9db37a5b12befa122eb4a86b04103b9a6b277c88e49bb521da61c6b/data/flutter_assets/packages/twemoji_flags/flags_dist/yt.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/db36569686581197c124c46db2b9e2def63d89a7a076966c4a6222250377616b/data/flutter_assets/packages/twemoji_flags/flags_dist/za.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/459a488cdbb71cebf73cb7dc9a3c1b08591de4d15f4184dc5c55052083a9d6d3/data/flutter_assets/packages/twemoji_flags/flags_dist/zm.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/e00899a94da1dea10ccd74cdb223a941305711e3285d2d6e081dcdb73a4ab99d/data/flutter_assets/packages/twemoji_flags/flags_dist/zw.svg.vec" Pattern match: "https://cdn.opcg-online.com/download/windows/files/0ddb6dd1d060d863b453c26aaae72d539d5dbc5443e086ef618280da73d71380/data/flutter_assets/shaders/ink_sparkle.frag" Pattern match: "https://cdn.opcg-online.com/download/windows/files/0ed3145e5e380355d92f9ccc66dba1c00d1b5001b1efa0dbeb6398dd56910486/data/flutter_assets/shaders/stretch_effect.frag" Pattern match: "https://cdn.opcg-online.com/download/windows/files/998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5/data/icudtl.dat" Pattern match: "https://cdn.opcg-online.com/download/windows/files/19b5826b8ce3821b55e5cd86a6e4477c77f899e9ceb4a7673259004b8ce57816/desktop_drop_plugin.dll" Pattern match: "https://cdn.opcg-online.com/download/windows/files/c3abab3156ef17f12e7bcb9e03e38122eff876c9bf2e6f9b77f1e273d06cbcb4/emoji_picker_flutter_plugin.dll" Pattern match: "https://cdn.opcg-online.com/download/windows/files/d2f071000bb976f6089972c55b348a6284c5f9b16316356ce4b25fd98b51d75a/file_selector_windows_plugin.dll" Pattern match: "https://cdn.opcg-online.com/download/windows/files/0611f0f901a8086aa5df5a7007218192a5020ab20d92b133628328cac6b08e6a/flutter_secure_storage_windows_plugin.dll" Pattern match: "https://cdn.opcg-online.com/download/windows/files/e225762642535e2f31b9ebb3d7def4dae93162d357e09bee241e19d461b9ff46/flutter_windows.dll" Pattern match: "https://cdn.opcg-online.com/download/windows/files/d799c9655118575d9689b8634666f28ed0096cf2bef4da0337bede1ab594f4da/opcg_online.exe" Pattern match: "https://cdn.opcg-online.com/download/windows/files/959e5160e7b380b227fd66c6ba13171ae4ef43f6a903b86a807462014acf5f99/url_launcher_windows_plugin.dll" Heuristic match: "\app.so" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "e.org" Pattern match: "http://www.monotype.com/studio" Pattern match: "http://www.google.com/get/noto/" Pattern match: "https://openfontlicense.org" Heuristic match: "3q.tc" Heuristic match: "!-.bb" Heuristic match: "breveacute.lc" Heuristic match: "brevegrave.lc" Heuristic match: "brevehook.lc" Heuristic match: "brevetilde.lc" Heuristic match: "circumflexacute.lc" Heuristic match: "circumflexgrave.lc" Heuristic match: "circumflexhook.lc" Heuristic match: "circumflextilde.lc" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?linkid=215117" Pattern match: "http://go.microsoft.com/fwlink/?linkid=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "https://www.msn.com/favicon.ico" Pattern match: "www.onet[1].xml" Heuristic match: "{app}\data\app.so" Heuristic match: "]6n.se"53:T15da3,Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001236.00000000.117871.F1AE4000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnj=@*se(k!(yesa(4[;@^" - Source: "00000000-00001236.00000001.119792.F2BA0000.00000002.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=fvolnxut4pjyixmcqey%2fwahpvcyux2jk1tloe5thqzy%2b2q2uywbh1bpfw2wqo24rgluzejhnczux4o%2fhsxl6gtykv6blwbj2kfpn5rfeil6at9cqzihrasz1wmkfixnuhnu3z4f2" - Source: "00000000-00001236.00000001.119792.F3600000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlentrust" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crlcomodo" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "https://certs.godaddy.com/repository/?" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "https://www.digicert.com/cps04020*0(https://www.digicert.com/cpsrootmicrosoft" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "http://ocsp.digicert.comdigicert" - Source: "00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnj=@*se(k!(yesa(4[;oracle" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002088.00000000.116613.00AE0000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found URL "https://npcap.com/@^" - Source: "00000000-00005348.00000000.117875.80780000.00000002.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/69ad0acd949c92cd014327bba8f476e6195734bb1113bec865a9024e0c05c9a9/data/flutter_assets/packages/twemoji_flags/flags_dist/vi.svg.vec" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.comj[p:b[x:z[@:r[h:09f[j[p:b[x:z[" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.coma[qf" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifbzx;zz" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlp'k:us1)0'" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlentrust" - Source: "00000000-00005348.00000000.117875.8156E000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005348.00000000.117875.815F6000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005348.00000000.117875.81600000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn9" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/861c5beff5fa2da08e3de76a06db9510117d3adec106d0d5c2956edde74a080e/data/flutter_assets/packages/twemoji_flags/flags_dist/mf.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/4b6090fc95600f61e95686bcd324d0a1476698343676a703cdedc7a02e5e878f/data/flutter_assets/packages/twemoji_flags/flags_dist/mg.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/11022f3b964c841d0aff655224d48383c4ada2c980cf09643fda16d0f8fe4a18/data/flutter_assets/packages/twemoji_flags/flags_dist/mh.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/e10207333a9733d5c100048q76a0be9d32518059e859e842469e60cb2/data/flutter_assets/packages/twemoji_flags/flags_dist/mk.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/e9d80fb3de9584af30ac34eb51d0de5eac1b74de34b0a596cad45265bca4133a/data/flutter_assets/packages/twemoji_flags/flags_dist/ml.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/ad06bbc0bce3f35ffc2739644d091f1aa136b52d261efe14cf1b687488bb0213/data/flutter_assets/packages/twemoji_flags/flags_dist/mm.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/e7b7935b6705d758e7ce23a1712c199b62648494b50efb9537fdc9744aa3a938/data/flutter_assets/packages/twemoji_flags/flags_dist/mn.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/77fa5df7058c9ec54a1d1ebfcdf4da2da23d3cb64d01ff13cab0fd7e/data/flutter_assets/packages/twemoji_flags/flags_dist/mo.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/882767cbbc8fb50943b180243df9d870839d43000e5261128b77a56aa36a36ca/data/flutter_assets/packages/twemoji_flags/flags_dist/mp.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/7bc52222740521834b0662e0163cdad219ab701739fc6929b192d0de46cc502e/data/flutter_assets/packages/twemoji_flags/flags_dist/mq.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/69094b63c479fc17f5223644d1a9fc251c97d90a14f1a67d292f72bea099ab36/data/flutter_assets/packages/twemoji_flags/flags_dist/mr.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/28d4b8451d20b74a9edb288efda1a1118e648e699102991dc5b88e6ea/data/flutter_assets/packages/twemoji_flags/flags_dist/ms.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/715ac6131b3f2ba3295fa73f6575d5c0ada0a1d4f02f91c0779a2b298667f776/data/flutter_assets/packages/twemoji_flags/flags_dist/mt.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/7d413d2565d7ff5f430a592767f36ad438e93a0950116516176098cf442fa14b/data/flutter_assets/packages/twemoji_flags/flags_dist/mu.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/4e9714948666489fb7d453acdcbe88d1b71733819698d1de59373c3105e39f9c/data/flutter_assets/packages/twemoji_flags/flags_dist/mv.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/3ce114b75cea54a132d58d8a5ad0ba9fbe3d2af057133b2059965edf/data/flutter_assets/packages/twemoji_flags/flags_dist/mw.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/9399424d7357b4b48f5afcb1c50d358c7c0bcd06010926c0fef1bb9d0e1d0cce/data/flutter_assets/packages/twemoji_flags/flags_dist/mx.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/0b9ab21ae982fa4f49b8989d4655cbfc59802b8af96eb1e6e1be24f0d621b6af/data/flutter_assets/packages/twemoji_flags/flags_dist/my.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/b8e82e4a383840e84051401fb17b6c3e80d79d56dbbd95220f1e1adb6ea54325/data/flutter_assets/packages/twemoji_flags/flags_dist/mz.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/d59557e6f69d<721d1bffeb05618393392391c8f4e21a7a8f1709bc378170/data/flutter_assets/packages/twemoji_flags/flags_dist/na.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/c0bd3714626b65c4a43760232e4c4d8e6d93d7d73fc24dcaa5d1ead15c5cb7ea/data/flutter_assets/packages/twemoji_flags/flags_dist/nc.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/7a0e7bdd5b755045abc5b34b2f1ddd82a7eee34d20d717bb03b2d2c5be178a53/data/flutter_assets/packages/twemoji_flags/flags_dist/ne.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/a0e5cbce2ceda5d25569b93444de335f7f312b6555d4f519b3fdd380620e382f/data/flutter_assets/packages/twemoji_flags/flags_dist/nf.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/d2433b2wf011d7bfb6c5a4e1a62c2ffa005372676793dce5aae27edb4/data/flutter_assets/packages/twemoji_flags/flags_dist/ng.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/3960f34bb24017fcb241be89603d49425b21d60e6a8350e26e922bdd2ee66ddc/data/flutter_assets/packages/twemoji_flags/flags_dist/ni.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/71b0256a3a66d3d95673ed5619fbd965d7865a9223c285666001047e8e049089/data/flutter_assets/packages/twemoji_flags/flags_dist/nl.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/792b8948e667657d7c5d149372cdd131049bf2528ebaf62c6f13ccd5028862da/data/flutter_assets/packages/twemoji_flags/flags_dist/no.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/9b2319f3bc6fa31084e8023aca173501ba3361017d9bbe1de66aab65/data/flutter_assets/packages/twemoji_flags/flags_dist/np.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/ebf6c81d582dfabe2c3cdfca4bcd5b666ab730d0efeeb4385e6221b80bbbc949/data/flutter_assets/packages/twemoji_flags/flags_dist/nr.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/27af785d807766ed766b62d5ca056a843764d9e8199c047a385899621a0919ff/data/flutter_assets/packages/twemoji_flags/flags_dist/nu.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/28474affa2e1e15c5460abf2586e96e9018e38cf62d922a753e88440cbb65f84/data/flutter_assets/packages/twemoji_flags/flags_dist/nz.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/ack6=4;766c32b9f674c5e5b634adbb638dd6e8484dffb643a838ad0ac02a/data/flutter_assets/packages/twemoji_flags/flags_dist/om.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/a5fce864790ba8ce68c6776c9fd11ad6a56b4f06e359cf81c28ab1366197fc53/data/flutter_assets/packages/twemoji_flags/flags_dist/pa.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/1fcc703e70a9d9cc3569c9971d508f2cde16cae3b2f2db9014108e75695aff6e/data/flutter_assets/packages/twemoji_flags/flags_dist/pe.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/a737d53d313c269e3e9c831c962d5e75587a4a949f7e4e735e8b49b74c95cf1d/data/flutter_assets/packages/twemoji_flags/flags_dist/pf.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/95308047dd3d57071bbfaa449a8b447f18fcf60c0a40daa87b66708b/data/flutter_assets/packages/twemoji_flags/flags_dist/pg.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/265e6798be866cd1285c58314785ddb59c3e7055bcf91861dd7c45e1b08c4596/data/flutter_assets/packages/twemoji_flags/flags_dist/ph.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/f8772d5cbcf51f02a04eec2d4b2964f359439dcf9c89e6b5a1ac050addf2de48/data/flutter_assets/packages/twemoji_flags/flags_dist/pk.svg.vec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "https://+downpackages_disvec" - Source: "00000000-00005348.00000000.117875.8199D000.00000004.mdmp") Found URL "http://docs.oasis-jvu" - Source: "00000000-00005348.00000000.117875.F74A0000.00000004.mdmp") Found URL "http://www.unicode.org/copyright.html" - Source: "00000000-00005348.00000000.117875.FB950000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crlhttp://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crlhttp://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl-.>" - Source: "00000000-00005348.00000000.117875.FD380000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crlgfor" - Source: "00000000-00005348.00000000.117875.FD380000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerthighassuranceevrootca.crlvcers8ntalpbr" - Source: "00000000-00005348.00000000.117875.FD380000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005348.00000000.117875.FF5B4000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdfovx" - Source: "00000000-00005348.00000000.117875.FF5B4000.00000004.mdmp") Found URL "https://github.com/googlefonts/arimo)version" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "http://www.monotype.com/studioarimo" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "http://www.google.com/get/noto/this" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "https://openfontlicense.orghttps://openfontlicense.orgarimo-regularregulararimoarimo" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "https://openfontlicense.orghttps://openfontlicense.orgarimo-italicitalicarimoarimo" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "https://openfontlicense.orghttps://openfontlicense.orgarimo-boldboldarimoarimo" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "https://openfontlicense.orghttps://openfontlicense.orgarimo-bolditalicbold" - Source: "00000000-00005348.00000001.119796.80280000.00000004.mdmp") Found URL "https://github.com/googlefonts/arimo)arimobold1.33;goog;arimo-boldarimo" - Source: "00000000-00005348.00000001.119796.80700000.00000002.mdmp") Found URL "http://www.google.com/get/noto/http://www.monotype.com/studiothis" - Source: "00000000-00005348.00000001.119796.80700000.00000002.mdmp") Found URL "https://openfontlicense.orghttps://openfontlicense.org" - Source: "00000000-00005348.00000001.119796.80700000.00000002.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/69ad0acd949c92cd014327bba8f476e6195734bb1113bec865a9024e0c05c9a9/data/flutter_assets/packages/twemoji_flags/flags_dist/vi.svg.vec" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.comj[p:b[x:z[@:r[h:09f[j[p:b[x:z[" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.coma[qf" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifbzx;zz" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlp'k:us1)0'" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlentrust" - Source: "00000000-00005348.00000001.119796.8156E000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005348.00000001.119796.815F4000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn9" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/861c5beff5fa2da08e3de76a06db9510117d3adec106d0d5c2956edde74a080e/data/flutter_assets/packages/twemoji_flags/flags_dist/mf.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/4b6090fc95600f61e95686bcd324d0a1476698343676a703cdedc7a02e5e878f/data/flutter_assets/packages/twemoji_flags/flags_dist/mg.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/11022f3b964c841d0aff655224d48383c4ada2c980cf09643fda16d0f8fe4a18/data/flutter_assets/packages/twemoji_flags/flags_dist/mh.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/e10207333a9733d5c100048q76a0be9d32518059e859e842469e60cb2/data/flutter_assets/packages/twemoji_flags/flags_dist/mk.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/e9d80fb3de9584af30ac34eb51d0de5eac1b74de34b0a596cad45265bca4133a/data/flutter_assets/packages/twemoji_flags/flags_dist/ml.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/ad06bbc0bce3f35ffc2739644d091f1aa136b52d261efe14cf1b687488bb0213/data/flutter_assets/packages/twemoji_flags/flags_dist/mm.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/e7b7935b6705d758e7ce23a1712c199b62648494b50efb9537fdc9744aa3a938/data/flutter_assets/packages/twemoji_flags/flags_dist/mn.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/77fa5df7058c9ec54a1d1ebfcdf4da2da23d3cb64d01ff13cab0fd7e/data/flutter_assets/packages/twemoji_flags/flags_dist/mo.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/882767cbbc8fb50943b180243df9d870839d43000e5261128b77a56aa36a36ca/data/flutter_assets/packages/twemoji_flags/flags_dist/mp.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/7bc52222740521834b0662e0163cdad219ab701739fc6929b192d0de46cc502e/data/flutter_assets/packages/twemoji_flags/flags_dist/mq.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/69094b63c479fc17f5223644d1a9fc251c97d90a14f1a67d292f72bea099ab36/data/flutter_assets/packages/twemoji_flags/flags_dist/mr.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/28d4b8451d20b74a9edb288efda1a1118e648e699102991dc5b88e6ea/data/flutter_assets/packages/twemoji_flags/flags_dist/ms.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/715ac6131b3f2ba3295fa73f6575d5c0ada0a1d4f02f91c0779a2b298667f776/data/flutter_assets/packages/twemoji_flags/flags_dist/mt.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/7d413d2565d7ff5f430a592767f36ad438e93a0950116516176098cf442fa14b/data/flutter_assets/packages/twemoji_flags/flags_dist/mu.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/4e9714948666489fb7d453acdcbe88d1b71733819698d1de59373c3105e39f9c/data/flutter_assets/packages/twemoji_flags/flags_dist/mv.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/3ce114b75cea54a132d58d8a5ad0ba9fbe3d2af057133b2059965edf/data/flutter_assets/packages/twemoji_flags/flags_dist/mw.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/9399424d7357b4b48f5afcb1c50d358c7c0bcd06010926c0fef1bb9d0e1d0cce/data/flutter_assets/packages/twemoji_flags/flags_dist/mx.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/0b9ab21ae982fa4f49b8989d4655cbfc59802b8af96eb1e6e1be24f0d621b6af/data/flutter_assets/packages/twemoji_flags/flags_dist/my.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/b8e82e4a383840e84051401fb17b6c3e80d79d56dbbd95220f1e1adb6ea54325/data/flutter_assets/packages/twemoji_flags/flags_dist/mz.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/d59557e6f69d<721d1bffeb05618393392391c8f4e21a7a8f1709bc378170/data/flutter_assets/packages/twemoji_flags/flags_dist/na.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/c0bd3714626b65c4a43760232e4c4d8e6d93d7d73fc24dcaa5d1ead15c5cb7ea/data/flutter_assets/packages/twemoji_flags/flags_dist/nc.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/7a0e7bdd5b755045abc5b34b2f1ddd82a7eee34d20d717bb03b2d2c5be178a53/data/flutter_assets/packages/twemoji_flags/flags_dist/ne.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/a0e5cbce2ceda5d25569b93444de335f7f312b6555d4f519b3fdd380620e382f/data/flutter_assets/packages/twemoji_flags/flags_dist/nf.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/d2433b2wf011d7bfb6c5a4e1a62c2ffa005372676793dce5aae27edb4/data/flutter_assets/packages/twemoji_flags/flags_dist/ng.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/3960f34bb24017fcb241be89603d49425b21d60e6a8350e26e922bdd2ee66ddc/data/flutter_assets/packages/twemoji_flags/flags_dist/ni.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/71b0256a3a66d3d95673ed5619fbd965d7865a9223c285666001047e8e049089/data/flutter_assets/packages/twemoji_flags/flags_dist/nl.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/792b8948e667657d7c5d149372cdd131049bf2528ebaf62c6f13ccd5028862da/data/flutter_assets/packages/twemoji_flags/flags_dist/no.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/9b2319f3bc6fa31084e8023aca173501ba3361017d9bbe1de66aab65/data/flutter_assets/packages/twemoji_flags/flags_dist/np.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/ebf6c81d582dfabe2c3cdfca4bcd5b666ab730d0efeeb4385e6221b80bbbc949/data/flutter_assets/packages/twemoji_flags/flags_dist/nr.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/27af785d807766ed766b62d5ca056a843764d9e8199c047a385899621a0919ff/data/flutter_assets/packages/twemoji_flags/flags_dist/nu.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/28474affa2e1e15c5460abf2586e96e9018e38cf62d922a753e88440cbb65f84/data/flutter_assets/packages/twemoji_flags/flags_dist/nz.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/ack6=4;766c32b9f674c5e5b634adbb638dd6e8484dffb643a838ad0ac02a/data/flutter_assets/packages/twemoji_flags/flags_dist/om.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/a5fce864790ba8ce68c6776c9fd11ad6a56b4f06e359cf81c28ab1366197fc53/data/flutter_assets/packages/twemoji_flags/flags_dist/pa.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/1fcc703e70a9d9cc3569c9971d508f2cde16cae3b2f2db9014108e75695aff6e/data/flutter_assets/packages/twemoji_flags/flags_dist/pe.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/a737d53d313c269e3e9c831c962d5e75587a4a949f7e4e735e8b49b74c95cf1d/data/flutter_assets/packages/twemoji_flags/flags_dist/pf.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/95308047dd3d57071bbfaa449a8b447f18fcf60c0a40daa87b66708b/data/flutter_assets/packages/twemoji_flags/flags_dist/pg.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/265e6798be866cd1285c58314785ddb59c3e7055bcf91861dd7c45e1b08c4596/data/flutter_assets/packages/twemoji_flags/flags_dist/ph.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://cdn.opcg-online.com/download/windows/files/f8772d5cbcf51f02a04eec2d4b2964f359439dcf9c89e6b5a1ac050addf2de48/data/flutter_assets/packages/twemoji_flags/flags_dist/pk.svg.vec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "https://+downpackages_disvec" - Source: "00000000-00005348.00000001.119796.8199D000.00000004.mdmp") Found URL "http://docs.oasis-jvu" - Source: "00000000-00005348.00000001.119796.F74A0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json10/05" - Source: "00000000-00005348.00000001.119796.FBA40000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,010/05" - Source: "00000000-00005348.00000001.119796.FBA40000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crlhttp://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crlhttp://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl-.>" - Source: "00000000-00005348.00000001.119796.FD545000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crlgfor" - Source: "00000000-00005348.00000001.119796.FD545000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerthighassuranceevrootca.crlvcers8ntalpbr" - Source: "00000000-00005348.00000001.119796.FD545000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005348.00000001.119796.FF5A4000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdfovx" - Source: "00000000-00005348.00000001.119796.FF5A4000.00000004.mdmp")54:T67c,Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp")55:T560,Found registry query API: "RegOpenKeyExW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegQueryValueExW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegEnumKeyExW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegSaveKeyW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegEnumValueW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegQueryInfoKeyW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegGetValueW" in file "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" Found registry query API: "RegGetValueW" in "00000000-00001236.00000001.119792.046FF000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001236.00000001.119792.9568F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001236.00000001.119792.9568F000.00000002.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in "00000000-00002088.00000000.116613.05000000.00000004.mdmp"56:Tb6e,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "FindFirstFileW" with parameter C:\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.en-US (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "FindFirstFileW" with parameter C:\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.en (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "FindFirstFileW" with parameter C:\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.ENU (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" called "FindFirstFileW" with parameter C:\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.EN (UID: 00000000-00004780) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.en-US (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.en (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.ENU (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.EN (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Programs\OPCG Online\unins???.* (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-85FC4VKCEM.tmp\* (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindNextFileW" with parameter .. (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindNextFileW" with parameter _isetup (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindFirstFileW" with parameter %TEMP%\is-85FC4VKCEM.tmp\_isetup\* (UID: 00000000-00002088) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" called "FindNextFileW" with parameter _setup64.tmp (UID: 00000000-00002088)57:T482,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "8996369201,7236,3120,,FindNextFileW,kernel32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8999984057,7236,3120,,FindNextFileW,kernel32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "8997955267,7236,3120,,FindNextFileW,kernel32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp")58:T902,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetTempDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found reference to API "empDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp")59:Td01,file/memory contains long string with (Indicator: "password"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found string "Please specify the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found string "The password you specified is not correct. Please try again." (Indicator: "password"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") file/memory contains long string with (Indicator: "password"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found string "fy the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "00000000-00004780.00000001.117653.00CF1000.00000020.mdmp") Found string "Set password" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3600000.00000004.mdmp, 00000000-00001236.00000001.119792.F3600000.00000004.mdmp") Found string "Change password" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "Confirm new password" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "Confirm passwordt" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "Current passwordt" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "Forgot password?t" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "If this email exists, a password reset link was sent." (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "New password" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "[<'account-password'>]-reveal" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3700000.00000004.mdmp, 00000000-00001236.00000001.119792.F3700000.00000004.mdmp") Found string "Forgot password?" (Indicator: "password"; Source: "00000000-00001236.00000000.117871.F3B4C000.00000004.mdmp, 00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp") Found string "The password is incorrect" (Indicator: "password"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp")5a:T5c2,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "function DeleteFile(const FileName: String): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00002088.00000000.116613.05000000.00000004.mdmp") Found reference to API "8999816235,7236,3137,,RemoveDirectoryW,kernel32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp") Found reference to API "9000763475,7236,3137,,RemoveDirectoryW,kernel32.dll,"00:30:37.828",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002088.00000001.117636.00B02000.00000004.mdmp")5b:T4e8,Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe")5c:Tbe9,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-HU6IX5YFB0.TMP\044EF3D12EFBAC04A7DBDD40F4E51CD2CDC9C077B0D5D3CB571A2562A74BF9C4.TMP"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\PROGRAMS\OPCG ONLINE\OPCG_ONLINE.EXE"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "opcg_online.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")5d:T206d,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "2808000084ABF0E11155DD0100") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "BC66647C157CDE07280CB3D3F0CE6BF7C779BF2F36E8417D28E8E5EE41EDC81000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Programs\OPCG Online\desktop_drop_plugin.dll") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "T>��z") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "6.7.3") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INNO SETUP: APP PATH"; Value: "%LOCALAPPDATA%\Programs\OPCG Online") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INSTALLLOCATION"; Value: "%LOCALAPPDATA%\Programs\OPCG Online\") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "OPCG Online") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INNO SETUP: USER"; Value: "xtuzfhW") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "default") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "DISPLAYNAME"; Value: "OPCG Online version 0.14.0-alpha.24+426") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "DISPLAYICON"; Value: "%LOCALAPPDATA%\Programs\OPCG Online\opcg_online.exe") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "UNINSTALLSTRING"; Value: ""%LOCALAPPDATA%\Programs\OPCG Online\unins000.exe"") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""%LOCALAPPDATA%\Programs\OPCG Online\unins000.exe" /SILENT") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "DISPLAYVERSION"; Value: "0.14.0-alpha.24+426") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "PUBLISHER"; Value: "OPCG Online") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "NOMODIFY"; Value: "0100000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "NOREPAIR"; Value: "0100000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "INSTALLDATE"; Value: "20261005") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "MAJORVERSION"; Value: "0000000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "MINORVERSION"; Value: "0E00000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "VERSIONMAJOR"; Value: "0000000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "VERSIONMINOR"; Value: "0E00000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1"; Key: "ESTIMATEDSIZE"; Value: "34C8000000") "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6422000000000000040004000100010001010000F1D9A3007900020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B0021777A00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB500682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BC6EB400BCFA8D00BD539800BE0CAC00C046AD00C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00CF74AA00D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C0058000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC005CE17D00624F980069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000300400100000571AE00682C9000F1D9A300010043010000C0EC7C0000")5e:Tf4f,Dropped file: "is-XUTMEOLQIU.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-XUTMEOLQIU.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-1T0ZXBRO12.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\is-1T0ZXBRO12.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-1LR7U5K4I3.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1LR7U5K4I3.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-6JB3DA16U1.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\fonts\is-6JB3DA16U1.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-1M2SXJ3O98.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\is-1M2SXJ3O98.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-VYELM2CN3Q.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-VYELM2CN3Q.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-FA91LXFA4T.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-FA91LXFA4T.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-BVEO9B5ZXV.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-BVEO9B5ZXV.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-DWDHSWL6JI.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-DWDHSWL6JI.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-0XIC5ZGQH4.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-0XIC5ZGQH4.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-GL3CZNE200.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-GL3CZNE200.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-KTHKMVSC4R.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-KTHKMVSC4R.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-H6HSH8WC8R.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-H6HSH8WC8R.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-VT8RNW2SQQ.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-VT8RNW2SQQ.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-4TNMBWMI6Q.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\ui\battle\is-4TNMBWMI6Q.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-EMJVXWXHVV.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\fonts\is-EMJVXWXHVV.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-NUNLJ1G776.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-NUNLJ1G776.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-1KSJHKZRY8.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1KSJHKZRY8.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-PFKHS2C70Y.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-PFKHS2C70Y.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-37NLDM14GH.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\is-37NLDM14GH.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-A8UG3JXWTF.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-A8UG3JXWTF.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-MT44135ELJ.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-MT44135ELJ.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-E3I9PRQ53X.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\assets\localization\is-E3I9PRQ53X.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-U7ESQDXKLZ.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-U7ESQDXKLZ.tmp]- [targetUID: 00000000-00002088] Dropped file: "is-OYYQF5ZECP.tmp" - Location: [%LOCALAPPDATA%\Programs\OPCG Online\data\flutter_assets\packages\twemoji_flags\flags_dist\is-OYYQF5ZECP.tmp]- [targetUID: 00000000-00002088]5f:Te31,Found string "GetLogicalProcessorInformation" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadPreferredUILanguages" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadPreferredUILanguages" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadUILanguage" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe, API is part of module: OLEAUT32.DLL)60:T635,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"61:T7d9,"is-XUTMEOLQIU.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-XUTMEOLQIU.tmp]- [targetUID: 00000000-00002088] "is-1LR7U5K4I3.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1LR7U5K4I3.tmp]- [targetUID: 00000000-00002088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp]- [targetUID: 00000000-00002088] "is-NUNLJ1G776.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-NUNLJ1G776.tmp]- [targetUID: 00000000-00002088] "is-1KSJHKZRY8.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1KSJHKZRY8.tmp]- [targetUID: 00000000-00002088] "is-PFKHS2C70Y.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-PFKHS2C70Y.tmp]- [targetUID: 00000000-00002088] "is-A8UG3JXWTF.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-A8UG3JXWTF.tmp]- [targetUID: 00000000-00002088] "is-MT44135ELJ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-MT44135ELJ.tmp]- [targetUID: 00000000-00002088] "is-U7ESQDXKLZ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-U7ESQDXKLZ.tmp]- [targetUID: 00000000-00002088] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-85FC4VKCEM.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002088]62:T5b0,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" wrote 54272 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-85FC4VKCEM.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\is-1LR7U5K4I3.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...63:T7d9,"is-XUTMEOLQIU.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-XUTMEOLQIU.tmp]- [targetUID: 00000000-00002088] "is-1LR7U5K4I3.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1LR7U5K4I3.tmp]- [targetUID: 00000000-00002088] "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp]- [targetUID: 00000000-00002088] "is-NUNLJ1G776.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-NUNLJ1G776.tmp]- [targetUID: 00000000-00002088] "is-1KSJHKZRY8.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-1KSJHKZRY8.tmp]- [targetUID: 00000000-00002088] "is-PFKHS2C70Y.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-PFKHS2C70Y.tmp]- [targetUID: 00000000-00002088] "is-A8UG3JXWTF.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-A8UG3JXWTF.tmp]- [targetUID: 00000000-00002088] "is-MT44135ELJ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-MT44135ELJ.tmp]- [targetUID: 00000000-00002088] "is-U7ESQDXKLZ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Programs\OPCG Online\is-U7ESQDXKLZ.tmp]- [targetUID: 00000000-00002088] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-85FC4VKCEM.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002088]64:T514,"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Handle: 508) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-HU6IX5YFB0.tmp\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" (Handle: 508) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\opcg_online.exe" (Handle: 1536) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\opcg_online.exe" (Handle: 1536) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\opcg_online.exe" (Handle: 1540) "044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OPCG Online\opcg_online.exe" (Handle: 1540)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791236704434,"unified_at":"2026-10-05T21:45:04.434Z","metadata":{"hashes":{"sha256":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","sha1":"561bb088072fde29c3d2e0b3acc47970423128a5","md5":"2c980e5175e8dfd51144181904d7ba33","sha512":"91fefc92c8bf4484e414356290754e5a80f09317e8aaf76c21f5a708376ef9256761449a1bc44bce152824b86eceacf306f33b4d05009199fc1065b88698a221","ssdeep":"393216:L6SGYGqZ5W6r/12hdDgHF+X/k+/cGPB0v+vQo3irXfQ:WSGiWU2PYF+XcucGPCv+PizfQ","ssdeep_chunks":["393216:L6SGYGq","393216:6SGYGqZ","393216:SGYGqZ5","393216:GYGqZ5W","393216:YGqZ5W6","393216:GqZ5W6r","393216:qZ5W6r/","393216:Z5W6r/1","393216:5W6r/12","393216:W6r/12h","393216:6r/12hd","393216:r/12hdD","393216:/12hdDg","393216:12hdDgH","393216:2hdDgHF","393216:hdDgHF+","393216:dDgHF+X","393216:DgHF+X/","393216:gHF+X/k","393216:HF+X/k+","393216:F+X/k+/","393216:+X/k+/c","393216:X/k+/cG","393216:/k+/cGP","393216:k+/cGPB","393216:+/cGPB0","393216:/cGPB0v","393216:cGPB0v+","393216:GPB0v+v","393216:PB0v+vQ","393216:B0v+vQo","393216:0v+vQo3","393216:v+vQo3i","393216:+vQo3ir","393216:vQo3irX","393216:Qo3irXf","393216:o3irXfQ","786432:L6SGYGq","786432:6SGYGqZ","786432:SGYGqZ5","786432:GYGqZ5W","786432:YGqZ5W6","786432:GqZ5W6r","786432:qZ5W6r/","786432:Z5W6r/1","786432:5W6r/12","786432:W6r/12h","786432:6r/12hd","786432:r/12hdD","786432:/12hdDg","786432:12hdDgH","786432:2hdDgHF","786432:hdDgHF+","786432:dDgHF+X","786432:DgHF+X/","786432:gHF+X/k","786432:HF+X/k+","786432:F+X/k+/","786432:+X/k+/c","786432:X/k+/cG","786432:/k+/cGP","786432:k+/cGPB","786432:+/cGPB0","786432:/cGPB0v","786432:cGPB0v+","786432:GPB0v+v","786432:PB0v+vQ","786432:B0v+vQo","786432:0v+vQo3","786432:v+vQo3i","786432:+vQo3ir","786432:vQo3irX","786432:Qo3irXf","786432:o3irXfQ","393216:WSGiWU2","393216:SGiWU2P","393216:GiWU2PY","393216:iWU2PYF","393216:WU2PYF+","393216:U2PYF+X","393216:2PYF+Xc","393216:PYF+Xcu","393216:YF+Xcuc","393216:F+XcucG","393216:+XcucGP","393216:XcucGPC","393216:cucGPCv","393216:ucGPCv+","393216:cGPCv+P","393216:GPCv+Pi","393216:PCv+Piz","393216:Cv+Pizf","393216:v+PizfQ"],"imphash":"88016fcdef7f227c62171d0afad9aae4","pehash":"8757466a33d2424b69bbbe09a179a48768457604"},"file_info":{"file_name":"OPCG-Online-Setup-0.14.0-alpha.24+426_044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":16626378,"entropy":8,"compile_timestamp":"2026-05-22T12:17:58","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790983977000,"last_seen":1791236295000,"last_multi_scan":1791236295000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":11,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":718860,"raw_size":719360},{"name":".itext","virtual_address":"0xb1000","virtual_size":6348,"raw_size":6656},{"name":".data","virtual_address":"0xb3000","virtual_size":16188,"raw_size":16384},{"name":".bss","virtual_address":"0xb7000","virtual_size":29516},{"name":".idata","virtual_address":"0xbf000","virtual_size":4200,"raw_size":4608},{"name":".didata","virtual_address":"0xc1000","virtual_size":420,"raw_size":512},{"name":".edata","virtual_address":"0xc2000","virtual_size":113,"raw_size":512},{"name":".tls","virtual_address":"0xc3000","virtual_size":24},{"name":".rdata","virtual_address":"0xc4000","virtual_size":93,"raw_size":512},{"name":".reloc","virtual_address":"0xc5000","virtual_size":73708,"raw_size":73728},{"name":".rsrc","virtual_address":"0xd7000","virtual_size":54016,"raw_size":54272}],"section_names":[".text",".itext",".data",".bss",".idata",".didata",".edata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["urlscanio"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":241,"suspicious_count":14,"malicious_count":2,"total":257},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"UDS:Trojan.Generic.jyce","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Able to delete items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"suspicious","value":"Renames multiple files (often indicator of ransomware infection)"},{"type":"suspicious","value":"Drops PE files with misleading file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"},{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Found HTTP GET request without a User Agent"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Renames multiple files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to write/modify file content (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-Content\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"FindResourceW\" with parameter \"11111\" - (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"FindResourceW\" with parameter \"85025332\" - (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"FindResourceW\" with parameter \"84936764\" - (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"FindResourceW\" with parameter \"84905548\" - (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '14447840'}\" (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"LoadResource with parameter {'hModule': '17039360', 'hResInfo': '21347472'}\" (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"LoadResource with parameter {'hModule': '17039360', 'hResInfo': '21347632'}\" (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-HU6IX5YFB0.tmp (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-85FC4VKCEM.tmp\\_isetup (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-85FC4VKCEM.tmp (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryEx failed\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertFrom-Json\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"is-VT8RNW2SQQ.tmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002088.00000001.117636.0140D000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$26","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"opcg_online.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at A6410000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" set its error mode to SEM_FAILCRITICALERRORS\n \"opcg_online.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00004780-20076-9-00CFB7F0\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00004780-20076-14-00CF5560\n Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00004780-20076-119-00CFBED4\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00004780-20076-274-00CF6850\n Found reference to API SetSearchPathMode@KERNEL32.DLL at 00000000-00004780-20076-4637-00DA110A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ebx\n ecx in Stream UID: 00000000-00004780-20076-2196-00D13BC4\n Assembly shows XOR instruction xor dword ptr [eax]\n edi in Stream UID: 00000000-00004780-20076-2514-00CFF642\n Assembly shows XOR instruction xor al\n 11h in Stream UID: 00000000-00004780-20076-2554-00CF3556\n Assembly shows XOR instruction xor eax\n 000100CFh in Stream UID: 00000000-00004780-20076-2554-00CF3556\n Assembly shows XOR instruction xor al\n byte ptr [ebp-01h] in Stream UID: 00000000-00004780-20076-2793-00D14070\n Assembly shows XOR instruction xor al\n 01h in Stream UID: 00000000-00004780-20076-3492-00D88028","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000000.117871.EDDE0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.EDDE0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00AE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"json\" in header \"GET /download/manifest.json HTTP/1.1user-agent: Dart/3.11 (dart:io)accept-encoding: gziphost: cdn.opcg-online.com\"\n Contains base64 string in header \"dart\" in header \"GET /download/manifest.json HTTP/1.1user-agent: Dart/3.11 (dart:io)accept-encoding: gziphost: cdn.opcg-online.com\"\n Contains base64 string in header \"encoding\" in header \"GET /download/manifest.json HTTP/1.1user-agent: Dart/3.11 (dart:io)accept-encoding: gziphost: cdn.opcg-online.com\"\n Contains base64 string in header \"gziphost\" in header \"GET /download/manifest.json HTTP/1.1user-agent: Dart/3.11 (dart:io)accept-encoding: gziphost: cdn.opcg-online.com\"\n Contains base64 string in header \"opcg\" in header \"GET /download/manifest.json HTTP/1.1user-agent: Dart/3.11 (dart:io)accept-encoding: gziphost: cdn.opcg-online.com\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains asymmetric cryptographic functions (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains cryptographic functions of the CryptoAPI\n Matched sigs: Contains key cryptographic functions of the CryptoAPI","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"is-HB8O2B3YW1.tmp\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"is-FI9D0P02XK.tmp\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"is-CLBU2HPI1S.tmp\")\n Found string \"Copyright 2020 The Arimo Project Authors (https://github.com/googlefonts/arimo)\" (Indicator: \"github.com\"; Source: \"00000000-00001236.00000001.119792.F27A0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00001236.00000001.119792.F2BA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"Bc:\\program files\\oracle\\virtualbox guest additions\\vboxdrvinst.exe\" (Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00AE0000.00000004.mdmp\")\n Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"is-1KSJHKZRY8.tmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"_setup64.tmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002088-00000C2C-818547179\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found system information discovery API: \"WTSRegisterSessionNotification\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004780)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"EnumWindows\" with parameter \"9431736\" - (UID: 00000000-00002088)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"EnumWindows\" with parameter \"197390\" - (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$31","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetActiveWindow\" (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004780)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004780-20076-213-00CF6AC0\n GetTickCount@KERNEL32.DLL at 00000000-00004780-20076-2031-00D2ADB4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004780-20076-86-00CFC4B8\n FindFirstFileW@KERNEL32.DLL at 00000000-00004780-20076-119-00CFBED4\n FindFirstFileW@KERNEL32.DLL at 00000000-00004780-20076-2554-00CF3556","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00004780-20076-3714-00D98CA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00004780-20076-652-00D0E490\n GetLocalTime@KERNEL32.DLL at 00000000-00004780-20076-2182-00D0E440","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00004780-20076-1-00DA1000\n GetVersion@KERNEL32.DLL at 00000000-00004780-20076-2-00CFDF70\n GetVersion@KERNEL32.DLL at 00000000-00004780-20076-9-00CFB7F0\n GetVersionExW@KERNEL32.DLL at 00000000-00004780-20076-3750-00DA1228","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00004780-20076-85-00CFC60C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004780-20076-95-00CFBA6C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004780-20076-2744-00D10EA8\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004780-20076-2746-00D10EF4\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004780-20076-3729-00D99560","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00004780-20076-2210-00D0C3FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"opcg_online.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00004780-20076-8-00CFDF5C\n GetSystemInfo@KERNEL32.DLL at 00000000-00004780-20076-1380-00D38B5C\n GetSystemInfo@KERNEL32.DLL at 00000000-00004780-20076-3791-00D9A1C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver (00\" (Indicator: \"ver \") in Source: 00000000-00001236.00000000.117871.EDDE0000.00000004.mdmp\n 00000000-00001236.00000001.119792.EDDE0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00004780-20076-84-00CFC6DC\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00004780-20076-85-00CFC60C\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00004780-20076-94-00CFBD8C\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00004780-20076-3730-00D9958C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00004780-20076-14-00CF5560\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004780-20076-3676-00D938D0\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004780-20076-3677-00D939BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp edx, 05h\" and \"jne 00CFDF8Eh\" at 00000000-00004780-20076-2-00CFDF70\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp byte ptr [00DA9C10h], 00h\" and \"je 00CFB86Eh\" at 00000000-00004780-20076-9-00CFB7F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"opcg_online.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\044EF3D12EFBAC04A7DBDD40F4E51CD2CDC9C077B0D5D3CB571A2562A74BF9C4.TMP\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found registry modification API: \"RegLoadKeyW\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"is-1KSJHKZRY8.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001236.00000000.117871.946F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$37","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" /SL5=\" - (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Programs\\OPCG Online\\opcg_online.exe\"\" - (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$39","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cdn.opcg-online.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.86.38:443\"\n \"172.67.214.125:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001236.00000001.119792.9568F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00004780-20076-82-00CFC800\n LoadLibraryA@KERNEL32.DLL at 00000000-00004780-20076-2691-00CFE6F8\n LoadLibraryW@KERNEL32.DLL at 00000000-00004780-20076-3679-00D93F74\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004780-20076-3786-00DA1E60\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004780-20076-5335-00CFFA56\n LoadLibraryA@KERNEL32.DLL at 00000000-00004780-20076-5979-00CFE07A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \": ShellExecute error code\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001236.00000001.119792.9568F000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001236.00000001.119792.9568F000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001236.00000000.117871.946F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3f","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"opcg_online.exe\" failed to load missing module \"DWriteCore.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$40","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"rau@va.rra\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75700000\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74490000\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75700000\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74490000\n \"opcg_online.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AF380000\n \"opcg_online.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at ADE00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F50000\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F50000\n \"opcg_online.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AF800000\n \"opcg_online.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E9AE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7f5aef97f0000@ntdll.dll\"\n \"220023000000000018c7f5aef97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$43","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Join-Path\"; File: \"is-LZ67GZT1RT.tmp\")\n file/memory contains long string with (Indicator: \"Split-Path\"; File: \"is-LZ67GZT1RT.tmp\")\n file/memory contains long string with (Indicator: \"Test-Path\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$44","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (UID: 00000000-00002088) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (UID: 00000000-00002088) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cdn.opcg-online.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$45","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcrypt.dll\" [Source: 00000000-00004780-00000C2B-815912993]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00002088-00000C2B-817500142]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002088-00000C2B-817519315]\n Observed system executable string:\"%WINDIR%\\system32\\shfolder.dll\" [Source: 00000000-00002088-00000C2B-817656140]\n Observed system executable string:\"%WINDIR%\\system32\\Rstrtmgr.dll\" [Source: 00000000-00002088-00000C2B-817690009]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00002088-00000C2B-822087857]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" searching for class \"Shell_TrayWnd\"\n \"opcg_online.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" with commandline \"/SL5=\"$E003E\n15379160\n877568\nC:\\\\044ef3d12efbac04a7dbdd40f4e51cd ...\" (UID: 00000000-00002088), Spawned process \"opcg_online.exe\" (UID: 00000000-00001236), Spawned process \"opcg_online.exe\" (UID: 00000000-00005348)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" with commandline \"/SL5=\"$E003E\n15379160\n877568\nC:\\\\044ef3d12efbac04a7dbdd40f4e51cd ...\" (UID: 00000000-00002088), Spawned process \"opcg_online.exe\" (UID: 00000000-00001236), Spawned process \"opcg_online.exe\" (UID: 00000000-00005348)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-1LR7U5K4I3.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Setup Log 2026-10-05 #001.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" with commandline \"/SL5=\"$E003E\n15379160\n877568\nC:\\\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\" (UID: 00000000-00002088)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"New-Item \"; File: \"is-LZ67GZT1RT.tmp\")\n file/memory contains long string with (Indicator: \"Add-Content\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryEx failed\" (Indicator: \"LoadLibrary\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"opcg_online.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (UID: 4780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (UID: 2088)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" reads file \"c:\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4a","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OPCG Online\\OPCG Online.lnk\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OPCG Online\\OPCG Online.lnk\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\OPCG Online.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-hu6ix5yfb0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" writes file \"%temp%\\is-hu6ix5yfb0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\setup log 2026-10-05 #001.txt\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"opcg_online.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\OPCG Online\\logs\\opcg_safety.log\"\n \"opcg_online.exe\" writes a file \"%LOCALAPPDATA%\\OPCG Online\\logs\\opcg_safety.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /download/manifest.json\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Copy-Item \"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"%localappdata%\\programs\\opcg online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\mx.svg.vec\" [Source: 00000000-00002088-00000C57-827031843]\n Observed email domain:\"c:\\...\\programs\\opcg online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\mx.svg.vec\" [Source: 00000000-00002088-00000455-24282044312]\n Observed email domain:\"ymx.\" [Source: 00000000-00001236.00000000.117871.F3B4C000.00000004.mdmp\n 00000000-00001236.00000001.119792.F3AFE000.00000004.mdmp]\n Observed email domain:\"{app}\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\mx.svg.vec\" [Source: 00000000-00002088.00000000.116613.05000000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n \"192.168.0.2\"\n \"2.5.29.31\"\n \"2.5.29.16\"\n \"104.21.86.38\"\n \"172.67.214.125\"\n Potential IP \"192.168.1.20\" found in string \"ws://192.168.1.20:8080/ws\"\n \"5.1.32.0\"\n \"17.005.0107.0008\"\n \"2.13.0.0\"\n \"3.3.14.3\"\n \"2.53.0.0\"\n \"5.2.24.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /download/manifest.json HTTP/1.1\nuser-agent: Dart/3.11 (dart:io)\naccept-encoding: gzip\nhost: cdn.opcg-online.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://cdn.opcg-online.com/download/manifest.json","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.86.38\" on port \"443\"\n HTTPS traffic to \"172.67.214.125\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" appended encryption extension \".vec\" to 10+ files (.tmp) — SELECTIVE EXCLUSION: no system file types or protected directories touched","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSUnRegisterSessionNotification\" (Indicator: \"WTSUnRegisterSessionNotification\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4BDD81FB2C992E265004D5248E04]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001236.00000000.117871.EF990000.00000004.mdmp, 00000000-00001236.00000001.119792.EF990000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE0DFB35F3190DC3B3741BB0978BB5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"is-MT44135ELJ.tmp\")\n Found string \"GetClipboardData\" (File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found string \"DragQueryFileW\" (File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00001236.00000001.119792.99F9E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"function GetUserNameString: String;\" (Indicator: \"GetUserName\"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"opcg_online.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004780)\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetComputerNameW\" (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"opcg_online.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" called \"GetUserNameW\" (UID: 00000000-00002088)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"TChaCha20Ctx@\" (Indicator: \"chacha\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found string \"TChaCha20Context\" (Indicator: \"chacha\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found string \"C:\\Coding\\Is\\issrc-build\\Components\\ChaCha20.pas\" (Indicator: \"chacha\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"is-VT8RNW2SQQ.tmp\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"is-4TNMBWMI6Q.tmp\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"is-5NJTFKMX7D.tmp\")\n Found string \"KgBAAES\" (Indicator: \"aes\"; Source: \"00000000-00001236.00000001.119792.F2BA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Where-Object\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001236.00000000.117871.946F9000.00000002.mdmp, 00000000-00001236.00000001.119792.046FF000.00000002.mdmp, 00000000-00001236.00000001.119792.9568F000.00000002.mdmp, 00000000-00001236.00000001.119792.95972000.00000002.mdmp, 00000000-00001236.00000001.119792.99F9E000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")\n Found string \"Where should OPCG Online be installed?\" (Indicator: \"where \"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Content\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001236.00000000.117871.946F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001236.00000001.119792.046FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\")\n Found reference to API \"9003023632,7236,111,,GetSystemMetrics,user32.dll,\"00:30:37.828\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00001236.00000000.117871.946F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$59","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"opcg_online.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;\" in \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;\" in \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;\" in \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Programs\\OPCG Online\\opcg_online.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001236.00000000.117871.E99E0000.00000004.mdmp, 00000000-00001236.00000001.119792.E99E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002088.00000000.116613.00AE0000.00000004.mdmp, 00000000-00002088.00000001.117636.00AE0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"RedirectionGuard status for current process: Could not enable (SetProcessMitigationPolicy failed with error code 87)\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002088.00000000.116613.0140A000.00000004.mdmp, 00000000-00002088.00000001.117636.0140A000.00000004.mdmp\")\n Found reference to API \"8969349236,7236,113,,SystemParametersInfoW,user32.dll,\"00:30:37.812\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")\n Found reference to API \"8956691921,7236,113,,SystemParametersInfoW,user32.dll,\"00:30:37.812\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002088.00000001.117636.00B02000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"opcg_online.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" opened \"\\Device\\KsecDD\"\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" opened \"\\Device\\KsecDD\"\n \"opcg_online.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002088.00000000.116613.01403000.00000004.mdmp, 00000000-00002088.00000001.117636.01403000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; File: \"is-LZ67GZT1RT.tmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\")\n Found reference to API \"procedure CreateMutex(const Name: String);\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002088.00000000.116613.05000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp]- [targetUID: 00000000-00002088]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-85FC4VKCEM.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00002088]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5e","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1\"; Key: \"DISPLAYICON\"; Value: \"%LOCALAPPDATA%\\Programs\\OPCG Online\\opcg_online.exe\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1\"; Key: \"UNINSTALLSTRING\"; Value: \"\"%LOCALAPPDATA%\\Programs\\OPCG Online\\unins000.exe\"\")\n \"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{95F752D4-1ED8-47EA-9589-8E90F3EC0E2D}_IS1\"; Key: \"QUIETUNINSTALLSTRING\"; Value: \"\"%LOCALAPPDATA%\\Programs\\OPCG Online\\unins000.exe\" /SILENT\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001236.00000000.117871.EDDE0000.00000004.mdmp, 00000000-00001236.00000001.119792.EDDE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/24 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00004780-20076-3787-00D9A29C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$62","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Network Related","name":"Found HTTP GET request without a User Agent","description":"\"GET /download/manifest.json HTTP/1.1\nuser-agent: Dart/3.11 (dart:io)\naccept-encoding: gzip\nhost: cdn.opcg-online.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":7,"id":"network-41","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.86.38 on port 443 is sent without HTTP header\n TCP traffic to 172.67.214.125 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%LOCALAPPDATA%\\Programs\\OPCG Online\\opcg_online.exe\" connects to 104.21.86.38 on port 443 (TCP)\n Process \"%LOCALAPPDATA%\\Programs\\OPCG Online\\opcg_online.exe\" connects to 172.67.214.125 on port 443 (TCP); Domain: \"cdn.opcg-online.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"$63","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Renames multiple files (often indicator of ransomware infection)","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$64","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames multiple files with double extensions (often indicator of ransomware infection)","description":"\"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp\" renames more than 100 files with extension \".svg.vec\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"intel_graph":{"map":{"Domain:55a78ef14593f9fddad95cb55707111ced0f3c654f6e3a04d4a714292ed601a5":{"type":"Domain","value":"cdn.opcg-online.com","verdict":{"verdict":"unknown"}},"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4":{"type":"File","value":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:0667fe828a319681a688149aac8593979558c228a26383356ecb0c9417edef9e":{"type":"File","value":"0667fe828a319681a688149aac8593979558c228a26383356ecb0c9417edef9e"},"File:1a876c241c2324267a73c16ef963b40d5d5f846da922a2818b360d99351f50b9":{"type":"File","value":"1a876c241c2324267a73c16ef963b40d5d5f846da922a2818b360d99351f50b9"},"File:23a313ac708a338cb0b37c2d7b27c62f02e95bdae3476c76749521bc875d1e6b":{"type":"File","value":"23a313ac708a338cb0b37c2d7b27c62f02e95bdae3476c76749521bc875d1e6b"},"File:2cc2ef9878bbcf4076a328cde1d52984810ba8885a4cbfa7c8811a51da79ceb8":{"type":"File","value":"2cc2ef9878bbcf4076a328cde1d52984810ba8885a4cbfa7c8811a51da79ceb8"},"File:393269dbab8899f938db19783eca5eac92eb431f7ae0ab45b8349ca895f1a06b":{"type":"File","value":"393269dbab8899f938db19783eca5eac92eb431f7ae0ab45b8349ca895f1a06b"},"File:41b22bc8f0b51f932825d37bc55b5eb6ba67dfe599a626e4aff2b43b624f9f8c":{"type":"File","value":"41b22bc8f0b51f932825d37bc55b5eb6ba67dfe599a626e4aff2b43b624f9f8c"},"File:550f5e34ee0a828d7941b1fe9bc58b34e5260d3f33a61532e6d0a0114e79a5cf":{"type":"File","value":"550f5e34ee0a828d7941b1fe9bc58b34e5260d3f33a61532e6d0a0114e79a5cf"},"File:58f11591f142e9dc777fc8f52a9dc29d8f2113bbc4e3da7657b7d21a0644d546":{"type":"File","value":"58f11591f142e9dc777fc8f52a9dc29d8f2113bbc4e3da7657b7d21a0644d546"},"File:5942266ed398b155d7dc23e36833e7ec6be988f2439bdbeb8ef1bede808eaa91":{"type":"File","value":"5942266ed398b155d7dc23e36833e7ec6be988f2439bdbeb8ef1bede808eaa91"},"File:60a0e8ef0c04dd5dd69ffe91025fa2ae5836cbd35600a82ba031977557e2cb61":{"type":"File","value":"60a0e8ef0c04dd5dd69ffe91025fa2ae5836cbd35600a82ba031977557e2cb61"},"File:63973b65d7d72075b2b04051effaf999082027cb18c96f79ec11f2382b19b4e6":{"type":"File","value":"63973b65d7d72075b2b04051effaf999082027cb18c96f79ec11f2382b19b4e6"},"File:6d1c233cd2b7c307dd934f4db0c6da1d011876f8577d97a2b9569c093599ee82":{"type":"File","value":"6d1c233cd2b7c307dd934f4db0c6da1d011876f8577d97a2b9569c093599ee82"},"File:77c967d49d4ef4a63c39fbcd1e27892102e503e35a20983cb058430c4f268b34":{"type":"File","value":"77c967d49d4ef4a63c39fbcd1e27892102e503e35a20983cb058430c4f268b34"},"File:97e32fdfa86a9aa79b85ce20b63b8618a8bf3e1110a0e631fac7f73983417b55":{"type":"File","value":"97e32fdfa86a9aa79b85ce20b63b8618a8bf3e1110a0e631fac7f73983417b55"},"File:a5de79f0fe863ea0954757acb3d47b3ccd0a930ce3dd5b97230cd3866790a06e":{"type":"File","value":"a5de79f0fe863ea0954757acb3d47b3ccd0a930ce3dd5b97230cd3866790a06e"},"File:b79bf5a7a9ce6243489cacb06de37bb19ad3b8153ba78bf5d5a8ca29eb9df195":{"type":"File","value":"b79bf5a7a9ce6243489cacb06de37bb19ad3b8153ba78bf5d5a8ca29eb9df195"},"File:c2f31df81e627d27539f1faa12621dd8f5821b14a09fc9fb8d6c1235e7e718cb":{"type":"File","value":"c2f31df81e627d27539f1faa12621dd8f5821b14a09fc9fb8d6c1235e7e718cb"},"File:d764499922d2ccba8a0857a09e0034262b28b77b38274c680893e6f9cd19c727":{"type":"File","value":"d764499922d2ccba8a0857a09e0034262b28b77b38274c680893e6f9cd19c727"},"File:d7a8b187cf8444d4cfee102e8eae9e3043682fd5106d5d33ed677fe268a0e2ba":{"type":"File","value":"d7a8b187cf8444d4cfee102e8eae9e3043682fd5106d5d33ed677fe268a0e2ba"},"File:ffdf690e4357a392e4edcc3df0b3adb0302920f75e54f2e6eec355afbe7edcba":{"type":"File","value":"ffdf690e4357a392e4edcc3df0b3adb0302920f75e54f2e6eec355afbe7edcba"},"Ip:104.21.86.38":{"type":"Ip","value":"104.21.86.38"},"Ip:172.67.214.125":{"type":"Ip","value":"172.67.214.125"},"Url:/download/manifest.json":{"type":"Url","value":"/download/manifest.json"}},"chains":[{"id":"1556782628924157822","root":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","edges":[{"edge_kind":"contacted_domain","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"Domain:55a78ef14593f9fddad95cb55707111ced0f3c654f6e3a04d4a714292ed601a5"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","edges":[{"edge_kind":"contacted_ip","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"Ip:104.21.86.38"},{"edge_kind":"contacted_ip","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"Ip:172.67.214.125"},{"edge_kind":"contacted_domain","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"Domain:55a78ef14593f9fddad95cb55707111ced0f3c654f6e3a04d4a714292ed601a5"},{"edge_kind":"contacted_url","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"Url:/download/manifest.json"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","edges":[{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:77c967d49d4ef4a63c39fbcd1e27892102e503e35a20983cb058430c4f268b34"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:5942266ed398b155d7dc23e36833e7ec6be988f2439bdbeb8ef1bede808eaa91"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:63973b65d7d72075b2b04051effaf999082027cb18c96f79ec11f2382b19b4e6"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:60a0e8ef0c04dd5dd69ffe91025fa2ae5836cbd35600a82ba031977557e2cb61"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:550f5e34ee0a828d7941b1fe9bc58b34e5260d3f33a61532e6d0a0114e79a5cf"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:a5de79f0fe863ea0954757acb3d47b3ccd0a930ce3dd5b97230cd3866790a06e"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:0667fe828a319681a688149aac8593979558c228a26383356ecb0c9417edef9e"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:ffdf690e4357a392e4edcc3df0b3adb0302920f75e54f2e6eec355afbe7edcba"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:41b22bc8f0b51f932825d37bc55b5eb6ba67dfe599a626e4aff2b43b624f9f8c"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:97e32fdfa86a9aa79b85ce20b63b8618a8bf3e1110a0e631fac7f73983417b55"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:d7a8b187cf8444d4cfee102e8eae9e3043682fd5106d5d33ed677fe268a0e2ba"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:393269dbab8899f938db19783eca5eac92eb431f7ae0ab45b8349ca895f1a06b"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:c2f31df81e627d27539f1faa12621dd8f5821b14a09fc9fb8d6c1235e7e718cb"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:1a876c241c2324267a73c16ef963b40d5d5f846da922a2818b360d99351f50b9"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:58f11591f142e9dc777fc8f52a9dc29d8f2113bbc4e3da7657b7d21a0644d546"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:6d1c233cd2b7c307dd934f4db0c6da1d011876f8577d97a2b9569c093599ee82"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:2cc2ef9878bbcf4076a328cde1d52984810ba8885a4cbfa7c8811a51da79ceb8"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:b79bf5a7a9ce6243489cacb06de37bb19ad3b8153ba78bf5d5a8ca29eb9df195"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:23a313ac708a338cb0b37c2d7b27c62f02e95bdae3476c76749521bc875d1e6b"},{"edge_kind":"extracted","from_key":"File:044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","to_key":"File:d764499922d2ccba8a0857a09e0034262b28b77b38274c680893e6f9cd19c727"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":51,"imported_dlls_count":117,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":70,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":2,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["urlscanio"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"6ac418c7fe1b349dbb08a411","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Trojan.Generic","submit_name":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe","analysis_start_time":"2026-10-05T21:38:17+00:00","indicators_count":{"informative":241,"suspicious":50,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.86.38","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"address":"172.67.214.125","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"dns_resolutions":[{"domain":"cdn.opcg-online.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"http_requests":[{"host":"cdn.opcg-online.com","host_ip":"104.21.86.38:443","url":"/download/manifest.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /download/manifest.json HTTP/1.1\nuser-agent: Dart/3.11 (dart:io)\naccept-encoding: gzip\nhost: cdn.opcg-online.com","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"embedded_domains":[{"value":"github.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"cdn.opcg-online.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}],"processes":[{"pid":4780,"ppid":0,"name":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe","command_line":"","sha256":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4","normalized_path":"C:\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe","uid":"00000000-00004780","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACXUlEQVR4XuWX709SURjH72Zwh3dlswwrAyspgdSIIRJMYgPO1mrNCiuBUFASzQLTpZhpLV220Q+3Zmu9qLY229za3HxXf9u3cy5jMRqXm4DnRZ/tvLnnuefzPPee59xdQagBHpsepdf2jPdZJ3598CHkN/JLIhOx8JMzbOZD/BIQRQFvZ+3YftPPJwn2/tnoMjXzSYDRvRfyLtNB1RJ3Twu21vrk+M5T6u9TpMOgXOXOOw+2X7vwedmFzVUXvq248fW5B7lpl+J9qvn+0oOdda/8vgvjR85TcfGZmL1ijCokqQE63T5aYf7g+blxCVuvyle3mHRgLuGAJDaUjamazVWHvLhGI2A+ca5+IiUkScRGthe+3qN8Evi05MSXZ25oBYFPAoxUyMpPzrBbOH6OGQb9fr4JHG5urE8CuXSP3Pul10sxtjZVjEneIeh3/mOrflyw4arXgCbaaqVzxVy0tSvOM3niFsHJtlbFuL84IKk7xTIxr6o4UVQuZFc8TQWQTQZh7jhe+8UZGo2m7MKLVD5P5bOJIKaHCU4by5+GOp227FxFwpetuOI9i3TUjZUHfixPBvBkPIC5sbw8Q+VTUYKJMEFkwIc+mxluuxXhAT+i1wlM7Sd2Ly+wlvbjxRSVT/yRz8SpPJaXp6icbbZRutlGQkHEbgZl+XnLmerlBZaofOFeEI9H8/I0ld8vkrOdLstvEAxdC6Dt2JHayQsw+aMRgodMHiEYHyIYu03lgwTDVH6Xyu3dnVDaOzVhskgeZ3L6yH2uC6hLqykRH2RVB6Bv4fhz0qitosX+e34DobwVvVf0awsAAAAASUVORK5CYII="},{"pid":2088,"ppid":4780,"name":"044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp","command_line":"/SL5=\"$E003E,15379160,877568,C:\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.exe\"","sha256":"4d3f37045de76d63590c52598d3ade4ded8cd3c98d4e185a63e5358848c5879a","normalized_path":"%TEMP%\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp","parent_uid":"00000000-00004780","uid":"00000000-00002088"},{"pid":1236,"ppid":2088,"name":"opcg_online.exe","command_line":"","sha256":"d799c9655118575d9689b8634666f28ed0096cf2bef4da0337bede1ab594f4da","normalized_path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\opcg_online.exe","parent_uid":"00000000-00002088","uid":"00000000-00001236"},{"pid":5348,"ppid":2088,"name":"opcg_online.exe","command_line":"","sha256":"d799c9655118575d9689b8634666f28ed0096cf2bef4da0337bede1ab594f4da","normalized_path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\opcg_online.exe","parent_uid":"00000000-00002088","uid":"00000000-00005348"}],"all_imported_dlls":["ntdll.dll","aepic.dll","sfc_os.dll","combase.dll","setupapi.dll","psapi.dll","ntasn1.dll","ntshrui.dll","d3d11.dll","rmclient.dll","wship6.dll","sechost.dll","imm32.dll","uxtheme.dll","msasn1.dll","FWPUCLNT.DLL","shlwapi.dll","powrprof.dll","CoreMessaging.dll","IPHLPAPI.DLL","oleacc.dll","dxgi.dll","clbcatq.dll","ExplorerFrame.dll","sfc.dll","mswsock.dll","gdi32full.dll","oleaut32.dll","comdlg32.dll","version.dll","ucrtbase.dll","vcruntime140.dll","shell32.dll","flutter_secure_storage_windows_plugin.dll","winmm.dll","DataExchange.dll","fltLib.dll","rometadata.dll","dbghelp.dll","KernelBase.dll","RstrtMgr.dll","cldapi.dll","directmanipulation.dll","ResourcePolicyClient.dll","wow64cpu.dll","rpcrt4.dll","linkinfo.dll","file_selector_windows_plugin.dll","VxSSL32.dll","IconCodecService.dll","msvcp110_win.dll","userenv.dll","twinapi.appcore.dll","windows.storage.dll","propsys.dll","srvcli.dll","flutter_windows.dll","DWrite.dll","win32u.dll","SHCore.dll","cfgmgr32.dll","ncrypt.dll","ntmarta.dll","winmmbase.dll","bcrypt.dll","wtsapi32.dll","netutils.dll","WSHTCPIP.DLL","comctl32.dll","cscapi.dll","opengl32.dll","glu32.dll","dnsapi.dll","wshqos.dll","user32.dll","ole32.dll","CoreUIComponents.dll","wow64win.dll","kernel32.dll","WinTypes.dll","D3DCompiler_47.dll","wow64.dll","winhttp.dll","msimg32.dll","emoji_picker_flutter_plugin.dll","gdi32.dll","advapi32.dll","WindowsCodecs.dll","desktop_drop_plugin.dll","url_launcher_windows_plugin.dll","vcruntime140_1.dll","rasadhlp.dll","ws2_32.dll","profapi.dll","cryptsp.dll","msctf.dll","dwmapi.dll","apphelp.dll","mpr.dll","TextInputFramework.dll","crypt32.dll","sspicli.dll","cryptbase.dll","d3d9.dll","dcomp.dll","msvcrt.dll","bcryptprimitives.dll","thumbcache.dll","VxSSL64.dll","d3d10warp.dll","nsi.dll","msvcp140.dll","kernel.appcore.dll","UIAutomationCore.dll","msvcp_win.dll","winsta.dll","policymanager.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"is-0XIC5ZGQH4.tmp","sha256":"77c967d49d4ef4a63c39fbcd1e27892102e503e35a20983cb058430c4f268b34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-BVEO9B5ZXV.tmp","sha256":"5942266ed398b155d7dc23e36833e7ec6be988f2439bdbeb8ef1bede808eaa91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-CLBU2HPI1S.tmp","sha256":"63973b65d7d72075b2b04051effaf999082027cb18c96f79ec11f2382b19b4e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-DWDHSWL6JI.tmp","sha256":"60a0e8ef0c04dd5dd69ffe91025fa2ae5836cbd35600a82ba031977557e2cb61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-EMJVXWXHVV.tmp","sha256":"550f5e34ee0a828d7941b1fe9bc58b34e5260d3f33a61532e6d0a0114e79a5cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-FA91LXFA4T.tmp","sha256":"a5de79f0fe863ea0954757acb3d47b3ccd0a930ce3dd5b97230cd3866790a06e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-FI9D0P02XK.tmp","sha256":"0667fe828a319681a688149aac8593979558c228a26383356ecb0c9417edef9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-GL3CZNE200.tmp","sha256":"ffdf690e4357a392e4edcc3df0b3adb0302920f75e54f2e6eec355afbe7edcba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-H6HSH8WC8R.tmp","sha256":"41b22bc8f0b51f932825d37bc55b5eb6ba67dfe599a626e4aff2b43b624f9f8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-HB8O2B3YW1.tmp","sha256":"97e32fdfa86a9aa79b85ce20b63b8618a8bf3e1110a0e631fac7f73983417b55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-KTHKMVSC4R.tmp","sha256":"d7a8b187cf8444d4cfee102e8eae9e3043682fd5106d5d33ed677fe268a0e2ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-VYELM2CN3Q.tmp","sha256":"393269dbab8899f938db19783eca5eac92eb431f7ae0ab45b8349ca895f1a06b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-E3I9PRQ53X.tmp","sha256":"c2f31df81e627d27539f1faa12621dd8f5821b14a09fc9fb8d6c1235e7e718cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-5MKUGY4LB0.tmp","sha256":"1a876c241c2324267a73c16ef963b40d5d5f846da922a2818b360d99351f50b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-6A1FDS6Q4E.tmp","sha256":"58f11591f142e9dc777fc8f52a9dc29d8f2113bbc4e3da7657b7d21a0644d546","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-IN615IL5XU.tmp","sha256":"6d1c233cd2b7c307dd934f4db0c6da1d011876f8577d97a2b9569c093599ee82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-TKHGDADIRG.tmp","sha256":"2cc2ef9878bbcf4076a328cde1d52984810ba8885a4cbfa7c8811a51da79ceb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-4TNMBWMI6Q.tmp","sha256":"b79bf5a7a9ce6243489cacb06de37bb19ad3b8153ba78bf5d5a8ca29eb9df195","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-ERLKH8KBEI.tmp","sha256":"23a313ac708a338cb0b37c2d7b27c62f02e95bdae3476c76749521bc875d1e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"is-TYMAI2ZVCB.tmp","sha256":"d764499922d2ccba8a0857a09e0034262b28b77b38274c680893e6f9cd19c727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%TEMP%\\is-HU6IX5YFB0.tmp\\044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%TEMP%\\Setup Log 2026-10-05 #001.txt","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%TEMP%\\is-85FC4VKCEM.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-1LR7U5K4I3.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-MT44135ELJ.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-U7ESQDXKLZ.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-PFKHS2C70Y.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-NUNLJ1G776.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-XUTMEOLQIU.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-1KSJHKZRY8.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\is-A8UG3JXWTF.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\is-1T0ZXBRO12.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\is-1M2SXJ3O98.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\is-7ZO9TWMIMB.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\is-MPWW7FKRSL.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\is-HM295PBWE8.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\is-37NLDM14GH.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-KTHKMVSC4R.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-0XIC5ZGQH4.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-GL3CZNE200.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-FI9D0P02XK.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-H6HSH8WC8R.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-HB8O2B3YW1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-EMJVXWXHVV.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-VYELM2CN3Q.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-FA91LXFA4T.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-BVEO9B5ZXV.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-CLBU2HPI1S.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\fonts\\is-DWDHSWL6JI.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\localization\\is-E3I9PRQ53X.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\other\\small\\is-6A1FDS6Q4E.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\other\\small\\is-5MKUGY4LB0.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\other\\small\\is-TKHGDADIRG.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\other\\small\\is-IN615IL5XU.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\ui\\battle\\is-TYMAI2ZVCB.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\ui\\battle\\is-ERLKH8KBEI.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\ui\\battle\\is-VT8RNW2SQQ.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\ui\\battle\\is-WTZ3GUXL6D.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\ui\\battle\\is-4TNMBWMI6Q.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\ui\\navigation\\is-IUOGA1DJ52.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\assets\\updater\\is-LZ67GZT1RT.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\fonts\\is-6JB3DA16U1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-92TTPEB19O.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-TN9KMQKGW4.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-G6I7GYMCB8.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-XWDLDCSEPL.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-JXLPHVM331.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-40231KCGN8.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-NKVR0KERTK.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-P9TWTU842C.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-2878UTFAC8.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-RRGG1UL15H.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-KRERHPY4TZ.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-2B9C8WQ9TF.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-3VWHDTGDNG.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-J0IDAS6G59.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-1FWGUCTTG0.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-ESIJZFUA8A.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\Programs\\OPCG Online\\data\\flutter_assets\\packages\\twemoji_flags\\flags_dist\\is-8H7PLWCI1S.tmp","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\OPCG Online\\logs","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%APPDATA%\\OPCG Online\\OPCG Online","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\OPCG Online\\logs\\opcg_safety.log","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%LOCALAPPDATA%\\OPCG Online\\logs\\active_session.json","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%APPDATA%\\OPCG Online","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"path":"%APPDATA%\\OPCG Online\\OPCG Online\\shared_preferences.json","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2088:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2088:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2088:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Local\\SM0:2088:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"SM0:2088:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"SM0:2088:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"SM0:1236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Local\\SM0:1236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"SM0:5348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]},{"name":"Local\\SM0:5348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac418c7fe1b349dbb08a411"}]}]}},"report_ids":{"sandbox_job_ids":["6ac418c7fe1b349dbb08a411"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 044ef3d12efb… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 044ef3d12efb…. Malware family: Trojan.Generic. Threat score 85/100. 1/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 044ef3d12efb… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 044ef3d12efb…. Malware family: Trojan.Generic. Threat score 85/100. 1/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/044ef3d12efbac04a7dbdd40f4e51cd2cdc9c077b0d5d3cb571a2562a74bf9c4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 044ef3d12efb… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 044ef3d12efb…. Malware family: Trojan.Generic. Threat score 85/100. 1/26 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L65","11",{}]]